6.1
Moyenne
CVE-2023-6529 The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing…
Description
The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP VR 8.3 | premières → < 8.3.15 | 8.3.15 |
Autres CVE de WP VR
Les 4 CVE de WP VR →
CVE-2023-1414
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in…
4.3
Moyenne
CVE-2023-1413
The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in…
6.1
Moyenne
CVE-2023-0174
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before…
5.4
Moyenne