Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2024-35781

WordPress Word Balloon plugin <= 4.21.1 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YAHMAN Word Balloon allows PHP Local File Inclusion.This issue affects Word Balloon: from n/a through 4.21.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Back2nature
Products
Word Balloon
CVE-2022-4751

Word Balloon < 4.19.3 - Contributor+ Stored XSS via Shortcode

The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Back2nature
Products
Word Balloon
CVE-2023-5884

Word Balloon < 4.20.3 - Avatar Removal via CSRF

The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Back2nature
Products
Word Balloon