CVE-2023-6806

CVE-2023-6806 — Starbox plugin for WordPress stores XSS via Job Settings fields in all versions up to 3.4.8. Root cause: insufficient input sanitization/output escaping allows authenticated users with subscriber+ privileges to inject script executed by other users. Mitigation: upgrade to the fixe...

CVE-2024-1273

CVE-2024-1273 affects the Starbox WordPress plugin prior to 3.5.0. The issue arises from insufficient sanitization/escaping of certain parameters, allowing users with a Contributor role to perform Cross-Site Scripting (stored XSS) attacks. Affected version:

CVE-2024-7955

CVE-2024-7955 affects the Starbox WordPress plugin (versions prior to 3.5.2). The issue arises because the plugin does not fully sanitise/escape certain settings, enabling stored XSS by high-privilege users (e.g., Administrators) even when unfiltered_html is disallowed (such as in multisite setup...

CVE-2024-8239

The CVE-2024-8239 entry concerns the Starbox WordPress plugin (versions prior to 3.5.3). Affected component: rendering of social media profile URLs in certain contexts (e.g., malicious user profile or pages using the starbox shortcode). Root cause: improper handling/rendering leads to Stored XSS ...

CVE-2024-0366

CVE-2024-0366 affects WordPress plugin Starbox – the Author Box for Humans. It is an Insecure Direct Object Reference (IDOR) via an action function caused by missing validation on a user-controlled key, affecting all versions up to 3.4.7. Impact: subscribers could view plugin preferences and pote...

CVE-2024-0256

CVE-2024-0256 concerns the Starbox WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via Profile Display Name and Social Settings in all versions up to 3.4.8, caused by insufficient input sanitization and output escaping. It requires authenticated access at subscriber lev...