CVE-2023-4999

Horizontal scrolling announcement <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's [horizontal-scrolling] shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Horizontal Scrolling Announcement

CVE-2023-5466

Wp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Wp Anything Slider

CVE-2023-5439

Wp photo text slider 50 <= 8.0 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Wp Photo Text Slider 50

CVE-2023-5438

wp image slideshow <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode

The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Wp Image Slideshow

CVE-2023-5434

Superb slideshow gallery <= 13.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Superb Slideshow Gallery

CVE-2023-5431

Left right image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Left Right Image Slideshow Gallery

CVE-2023-5430

Jquery news ticker <= 3.0 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Jquery News Ticker

CVE-2023-5429

Information Reel <= 10.0 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Information Reel

CVE-2023-5464

Jquery accordion slideshow <= 8.1 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Jquery Accordion Slideshow

CVE-2023-5435

Up down image slideshow gallery <= 12.0 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Up Down Image Slideshow Gallery

CVE-2023-5428

Image vertical reel scroll slideshow <= 9.0 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Gopiplus

Products

Image Vertical Reel Scroll Slideshow

CVE-2023-5413

Image horizontal reel scroll slideshow <= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, and including, 13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Image Horizontal Reel Scroll Slideshow

CVE-2023-5412

Image horizontal reel scroll slideshow <= 13.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Gopiplus

Products

Image Horizontal Reel Scroll Slideshow

CVE-2023-25465

WordPress wp tell a friend popup form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy wp tell a friend popup form plugin <= 7.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Wp-tell-a-friend-popup-form

CVE-2023-24418

WordPress Tiny carousel horizontal slider plus Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin <= 3.2 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Tiny Carousel Horizontal Slider Plus

CVE-2022-46819

WordPress Continuous announcement scroller Plugin <= 13.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Continuous announcement scroller plugin <= 13.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Continuous Announcement Scroller

CVE-2023-44265

WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Popup contact form plugin <= 7.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Popup Contact Form

CVE-2023-44230

WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Popup contact form plugin <= 7.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Popup Contact Form

CVE-2023-44229

WordPress Tiny Carousel Horizontal Slider Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny Carousel Horizontal Slider plugin <= 8.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Tiny Carosel Horizontal Slider

CVE-2023-44228

WordPress Onclick Show Popup Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Onclick show popup plugin <= 8.1 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gopiplus

Products

Onclick Show Popup