CVE-2023-6806

CVE-2023-6806 — Starbox plugin for WordPress stores XSS via Job Settings fields in all versions up to 3.4.8. Root cause: insufficient input sanitization/output escaping allows authenticated users with subscriber+ privileges to inject script executed by other users. Mitigation: upgrade to the fixe...

CVE-2024-1273

The Starbox WordPress plugin versions prior to 3.5.0 are vulnerable to a Stored Cross-Site Scripting (XSS) attack (CWE-79). The root cause is the failure to properly sanitise and escape certain parameters. This allows users with a role as low as Contributor to execute malicious scripts. The issue...

CVE-2024-7955

The Starbox WordPress plugin (versions before 3.5.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitize and escape certain settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks even in environments where the unfilter...

CVE-2024-8239

The CVE-2024-8239 entry concerns the Starbox WordPress plugin (versions prior to 3.5.3). Affected component: rendering of social media profile URLs in certain contexts (e.g., malicious user profile or pages using the starbox shortcode). Root cause: improper handling/rendering leads to Stored XSS ...

CVE-2024-0366

CVE-2024-0366 affects WordPress plugin Starbox – the Author Box for Humans. It is an Insecure Direct Object Reference (IDOR) via an action function caused by missing validation on a user-controlled key, affecting all versions up to 3.4.7. Impact: subscribers could view plugin preferences and pote...

CVE-2024-0256

CVE-2024-0256 concerns the Starbox WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via Profile Display Name and Social Settings in all versions up to 3.4.8, caused by insufficient input sanitization and output escaping. It requires authenticated access at subscriber lev...