Plugin Planet
Products by Plugin Planet Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2024 there have been 0 vulnerabilities in Plugin Planet . Last year Plugin Planet had 8 security vulnerabilities published. Right now, Plugin Planet is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 8 | 6.35 |
| 2022 | 5 | 6.62 |
| 2021 | 2 | 5.75 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Plugin Planet vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Plugin Planet Security Vulnerabilities
Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts Enable Users to Submit Posts
CVE-2023-45603
9.8 - Critical
- December 20, 2023
Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts Enable Users to Submit Posts from the Front End: from n/a through 20230902.
Unrestricted File Upload
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite
CVE-2023-49743
4.8 - Medium
- December 14, 2023
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This issue affects Dashboard Widgets Suite: from n/a through 3.4.1.
XSS
The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2023-5614
5.4 - Medium
- October 20, 2023
The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
XSS
The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2023-4838
5.4 - Medium
- September 09, 2023
The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes like 'before' and 'after'. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
XSS
The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2023-4779
5.4 - Medium
- September 06, 2023
The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [usp_gallery] shortcode in versions up to, and including, 20230811 due to insufficient input sanitization and output escaping on user supplied attributes like 'before'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
XSS
The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting
CVE-2023-4308
5.4 - Medium
- August 15, 2023
The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user-submitted-content parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
XSS
The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to
CVE-2019-25138
9.8 - Critical
- June 07, 2023
The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Unrestricted File Upload
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabili
CVE-2023-26517
4.8 - Medium
- May 06, 2023
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeff Starr Dashboard Widgets Suite plugin <= 3.2.1 versions.
XSS
Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115
CVE-2022-27849
7.5 - High
- April 15, 2022
Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115
Information Disclosure
Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115
CVE-2022-27850
4.3 - Medium
- April 15, 2022
Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat message.
Session Riding
The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which
CVE-2022-1165
9.1 - Critical
- April 04, 2022
The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. This could also be abused by competitors to cause damage related to visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even the administrator and even more.
Insecure Direct Object Reference / IDOR
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code
CVE-2022-25610
6.1 - Medium
- March 25, 2022
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
XSS
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
CVE-2022-25601
6.1 - Medium
- March 11, 2022
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
XSS
The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue
CVE-2021-24409
6.1 - Medium
- July 12, 2021
The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
XSS
The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters
CVE-2021-24408
5.4 - Medium
- July 12, 2021
The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
XSS