32 matches found
CVE-2019-15837
The webp-express plugin before 0.14.8 for WordPress has stored XSS...
WordPress webp-express plugin information disclosure vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. webp-express is a plugin that converts images from other formats to webp format. An information disclosure vulnerability exists in the...
CVE-2019-15330
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading...
CVE-2019-15330
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading...
Design/Logic Flaw
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading...
CVE-2019-15330
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading...
CVE-2019-15330
The CVE concerns the WordPress plugin WebP Express (before version 0.14.11). It has insufficient protection against arbitrary file reading, enabling potential information disclosure. Affected component: webp-express plugin for WordPress; vulnerability arises from inadequate access controls around...
WordPress WebP Express plugin <= 0.14.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by M0ns7er in WordPress WebP Express plugin versions = 0.14.4. Solution Update the WordPress WebP Express plugin to the latest available version at least 0.14.8...
WebP Express <= 0.14.4 - Authenticated Stored XSS
Edit - WPScanTeam: The reported issue has been fixed in 0.14.5. Other sanitisation checks have been implemented in newest versions such as 0.14.6 and 0.14.8 while the plugin was closed, so the fixed in is set to 0.14.8 PoC Video POC :...
WebP Express <= 0.14.4 - Authenticated Stored XSS
Edit - WPScanTeam: The reported issue has been fixed in 0.14.5. Other sanitisation checks have been implemented in newest versions such as 0.14.6 and 0.14.8 while the plugin was closed, so the fixed in is set to 0.14.8 Video POC :...
WordPress WebP Express plugin <= 0.14.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found in WordPress WebP Express plugin versions = 0.14.0. Solution Update the WordPress WebP Express plugin to the latest available version at least 0.14.1...