Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2024-7568

Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion

The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin. CVE-2024-7864 appears to be a duplicate of this issue.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Pixeljar
Products
Favicon Generator
CVE-2024-11266

Geocache Stat Bar Widget <= 0.911 - Admin+ Stored XSS

The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pixeljar
Products
Geocache Stat Bar Widget
CVE-2024-7863

Favicon Generator < 2.1 - Arbitrary File Upload via CSRF

The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Pixeljar
Products
Favicon Generator
CVE-2024-7864

Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF

The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pixeljar
Products
Favicon Generator