CVE-2024-1958

The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users

CVE-2024-1956

The wpb-show-core WordPress plugin, in versions prior to 2.7 , is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to sanitise and escape parameters before outputting them in responses to unauthenticated requests . This flaw allows an attacker to e...

CVE-2024-1292

The WPB Show Core WordPress plugin versions prior to 2.7 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape certain parameters before outputting them back to the page. This vulnerability could be exploited against high-privilege users , su...

CVE-2023-5974

The CVE-2023-5974 issue affects the WordPress plugin WPB Show Core up to version 2.2. The vulnerability is a Server-Side Request Forgery (SSRF) in download-file.php via the path parameter, allowing unauthenticated attackers to induce the server to request arbitrary URLs. Exploitation details in c...

CVE-2022-3484

The CVE-2022-3484 entry relates to the WordPress WPB Show Core plugin, where a parameter is not sanitized/escaped before being echoed in the page, causing a Reflected Cross-Site Scripting vulnerability. Affected component: WPB Show Core WordPress plugin (specific version range not consistently sp...

CVE-2023-4922

Summary of CVE-2023-4922 : The WPB Show Core WordPress plugin (versions up to and including 2.2) is vulnerable to an unauthenticated local file inclusion via the path parameter. The attack surface centers on a local file inclusion in the plugin, exemplified by PoCs targeting files such as /etc/re...