CVE-2022-4751

CVE-2022-4751 affects the Word Balloon WordPress plugin prior to 4.19.3. The issue arises from not validating or escaping certain shortcode attributes before they’re output, enabling Stored XSS. This could allow users with a low privilege (as low as Contributor) to execute script against higher-p...

CVE-2023-5884

The CVE concerns Word Balloon WordPress plugin prior to 4.20.3. The issue is a CSRF flaw in some plugin actions that fails to protect against unauthorized requests, enabling an unauthenticated attacker to trick a logged-in admin into deleting arbitrary avatars by clicking a crafted link. Affected...

CVE-2024-35781

CVE-2024-35781 is a Word Balloon WordPress plugin vulnerability (authenticated) that allows PHP Local File Inclusion due to improper pathname limitation. Affected: Word Balloon up to and including version 4.21.1. Root cause: path traversal restricting access to restricted directories is insuffici...