Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2023-52134

WordPress GEO my WordPress Plugin <= 4.0.2 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my WordPress: from n/a through 4.0.2.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Geomywp
Products
Geo My Wordpress
CVE-2023-5467

GEO my WordPress <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Geomywp
Products
Geo My Wordpress
CVE-2024-9422

GEO My WordPress < 4.5 - Admin+ Arbitrary File Upload

The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Geomywp
Products
Geo My Wordpress Geo My Wordpress Premium Settings
CVE-2024-6330

GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI

The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Geo My Wp Geomywp
Products
Geo My Wp Geo My Wordpress