CVE-2024-0561

The Ultimate Posts Widget WordPress plugin versions prior to 2.3.1 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly validate and escape certain Widget options before they are outputted back in attributes. This flaw could allow high-privilege users, such...

CVE-2023-0958

CVE-2023-0958 affects WordPress plugins developed by Inisev that expose an inisev_installation AJAX action. The root cause is a missing capability check in the handle_installation function, enabling an authenticated attacker with minimal privileges (e.g., a subscriber) to install select Inisev pl...

CVE-2023-3977

CVE-2023-3977 describes a Cross‑Site Request Forgery (CSRF) in multiple Inisev WordPress plugins, due to a missing nonce on the handle_installation function invoked by inisev_installation via AJAX. This enables unauthenticated attackers to trigger installation of plugins from a limited list if a ...