CVE-2020-7107

The WordPress plugin Ultimate FAQ (WordPress plugin) prior to version 1.8.30 is vulnerable to Cross-Site Scripting (XSS) via the Display_FAQ parameter routed through Shortcodes/DisplayFAQs.php. The issue stems from insufficient sanitization of the Display_FAQ GET parameter, enabling an attacker t...

CVE-2021-24968

The CVE-2021-24968 affects the WordPress Ultimate FAQ plugin (versions prior to 2.1.2). The issue is a lack of capability and CSRF checks in the AJAX actions ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page, making them accessible to any authenticated user (down to Subscriber). This can...

CVE-2019-15643

CVE-2019-15643 affects the WordPress Ultimate FAQ plugin, specifically versions before 1.8.22, with a cross-site scripting (XSS) vulnerability. The root cause and exact exploitation details are not provided in the connected documents, but multiple sources corroborate the XSS risk in this plugin. ...