45 matches found
CVE-2024-30456
CVE-2024-30456 describes a Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WPCS (WordPress Currency Switcher Pro). The issue affects WPCS versions from unspecified earliest release up to 1.2.0.1. The CVE entry includes an CVSS vector with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicat...
CVE-2024-30456 WordPress WPCS – WordPress Currency Switcher Professional plugin <=1.2.0.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in realmag777 WPCS.This issue affects WPCS: from n/a through 1.2.0.1...
WordPress WPCS Plugin <= 1.2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software WPCS Type Plugin Vulnerable versions = 1.2.0.1 Fixed in 1.2.0.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-30456 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 88357d12cef3 Credits Dhabaleshwar Das Required...
CVE-2023-51506
CVE-2023-51506 affects WPCS – WordPress Currency Switcher Professional (Authenticated: Contributor+). It is a Stored Cross-Site Scripting vulnerability caused by improper input neutralization during web page generation. Affected product/version: WPCS Professional up to and including 1.2.0. Impact...
CVE-2023-51506 WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a through 1.2.0...
CVE-2023-51506 WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a through 1.2.0...
WordPress plugin WPCS cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)
Software WPCS Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51506 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 8263d2966a43 Credits Ngô Thiên An ancorn from VNPT-VCI Required...
CVE-2023-2558
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcscurrentcurrency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This...
CVE-2023-2557
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...
Design/Logic Flaw
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...
Design/Logic Flaw
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcssddelete action in versions up to, and including, 1.1.9. This makes it possible for authenticated...
CVE-2023-2555
CVE-2023-2555 affects the WPCS – WordPress Currency Switcher Professional plugin for WordPress. The issue arises from a missing capability check on the create function in versions up to and including 1.1.9, enabling authenticated attackers with subscriber-level permissions and above to create a c...
CVE-2023-2557 WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editing
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2023-2557
CVE-2023-2557 concerns the WPCS – WordPress Currency Switcher Professional plugin. The vulnerability is a missing capability check on the save function, allowing authenticated attackers with subscriber-level permissions or higher to modify an arbitrary custom drop-down currency switcher. Affected...
CVE-2023-2558
CVE-2023-2558 affects the WPCS – WordPress Currency Switcher Professional plugin for WordPress. It is a stored Cross‑Site Scripting (XSS) vulnerability in the wpcs_current_currency shortcode, caused by insufficient input sanitization and output escaping on user-supplied attributes. Affected versi...
CVE-2023-2556
CVE-2023-2556 involves the WPCS – WordPress Currency Switcher Professional plugin for WordPress (≤ 1.1.9). The vulnerability is a missing capability check in the wpcs_sd_delete action, enabling authenticated users with subscriber-level permissions and above to delete an arbitrary custom drop-down...
WordPress WPCS Plugin <= 1.1.9 is vulnerable to Broken Access Control
Software WPCS Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2556 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 05cf802e36e5 Credits Alex Thomas Required privilege...
WordPress WPCS Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)
Software WPCS Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2558 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d4269971d7d0 Credits Alex Thomas Required privileg...