Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2021-24968

Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Etoilewebdesign
Products
Ultimate Faq
CVE-2020-7107

The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Etoilewebdesign
Products
Ultimate Faq
CVE-2019-17233

Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.

CVSS 3.1 · 6.1 Medium EPSS 2.2% KEV · Not listed
Vendors
Etoilewebdesign
Products
Ultimate Faq
CVE-2019-17232

Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Etoilewebdesign
Products
Ultimate Faq