Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2023-0684

Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folders

The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as changing the folder structure maintained by the plugin.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wickedplugins
Products
Wicked Folders
CVE-2021-24919

Wicked Folders < 2.18.10 - Subscriber+ SQL Injection

The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Wickedplugins
Products
Wicked Folders