Non notée
CVE-2022-0200 Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before…
Description
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Themify Portfolio Post 1.1 | premières → < 1.1.7 | 1.1.7 |
Autres CVE de Themify Portfolio Post
Les 4 CVE de Themify Portfolio Post →
CVE-2023-0362
Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes…
5.4
Moyenne
CVE-2022-4464
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes…
5.4
Moyenne
CVE-2021-24129
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6,…
Non notée