CVE-2024-25902

CVE-2024-25902 : WordPress plugin miniorange Malware Scanner (v4.7.2 and earlier) is affected by an SQL Injection due to improper neutralization of inputs. The vulnerability is exploitable with administrator privileges (Wordfence notes “Authenticated (Administrator+) SQL Injection”) and is linked...

CVE-2022-1995

CVE-2022-1995 affects the WordPress plug-in “Malware Scanner” (miniOrange) prior to version 4.5.2. The issue arises because the plug-in does not sanitize and escape certain settings, allowing Highly privileged administrators to store malicious JavaScript, leading to client-side XSS when unfiltere...