Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2022-50955

WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery

WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Curtain Curtain Project Wordpress
Products
Curtain Curtain Wordpress
CVE-2022-1558

Curtain <= 1.0.2 - Admin+ Stored Cross-Site Scripting

The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS 1.0% KEV · Not listed
Vendors
Curtain Project
Products
Curtain