Ads By Datafeedr.com CVEs and Security Vulnerabilities

CVE-2023-49169

WordPress Ads by datafeedr.com Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in datafeedr.Com Ads by datafeedr.Com allows Stored XSS.This issue affects Ads by datafeedr.Com: from n/a through 1.2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Datafeedr

Products

Ads By Datafeedr.com

CVE-2023-5843

Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution

The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' function. This allows unauthenticated attackers to execute code on the server. The parameters of the callable function are limited, they cannot be specified arbitrarily.

CVSS 3.1 · 9 Critical EPSS 2.6% KEV · Not listed