Filtered by vendor Wow-company
Subscribe
Search
Total
11 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-52149 | 1 Wow-company | 1 Floating Button | 2024-01-09 | N/A | 8.8 HIGH |
| Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0. | |||||
| CVE-2023-49155 | 1 Wow-company | 1 Button Generator | 2023-12-21 | N/A | 8.8 HIGH |
| Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8. | |||||
| CVE-2023-27418 | 1 Wow-company | 1 Side Menu Lite | 2023-11-17 | N/A | 8.8 HIGH |
| Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite – add sticky fixed buttons plugin <= 4.0 versions. | |||||
| CVE-2023-3650 | 1 Wow-company | 1 Bubble Menu | 2023-08-09 | N/A | 4.8 MEDIUM |
| The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). | |||||
| CVE-2022-29447 | 1 Wow-company | 1 Hover Effects | 2022-06-02 | 4.0 MEDIUM | 7.2 HIGH |
| Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress. | |||||
| CVE-2022-29446 | 1 Wow-company | 1 Counter Box | 2022-05-26 | 4.0 MEDIUM | 7.2 HIGH |
| Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress. | |||||
| CVE-2021-25052 | 1 Wow-company | 1 Button Generator | 2022-01-14 | 5.1 MEDIUM | 8.8 HIGH |
| The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. | |||||
| CVE-2021-25053 | 1 Wow-company | 1 Wp Coder | 2022-01-14 | 5.1 MEDIUM | 8.8 HIGH |
| The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. | |||||
| CVE-2021-25051 | 1 Wow-company | 1 Modal Window | 2022-01-14 | 5.1 MEDIUM | 8.8 HIGH |
| The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE. | |||||
| CVE-2021-25054 | 1 Wow-company | 1 Wpcalc | 2022-01-14 | 6.5 MEDIUM | 8.8 HIGH |
| The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability. | |||||
| CVE-2021-24628 | 1 Wow-company | 1 Wow Forms | 2021-11-10 | 6.5 MEDIUM | 7.2 HIGH |
| The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection | |||||