CVE-2023-7246

The System Dashboard WordPress plugin versions before 2.8.10 is vulnerable to Cross-Site Scripting (XSS) due to improper sanitization and escaping of certain parameters. Specifically, the flaw allows for header injection via the X-Forwarded-For header. In a multisite WordPress configuration , aut...

CVE-2024-10708

The System Dashboard WordPress plugin versions prior to 2.8.15 is vulnerable to a path traversal attack. The root cause is a failure to validate user input used in a path, specifically through the filename parameter in the sd_viewer action. This allows high-privilege users, such as administrators...

CVE-2024-11107

The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.