deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1612
Published: 2022-06-13
Description: The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/a8cec792-6435-4047-bca8-597c104dbc1f; https://wpscan.com/vulnerability/a8cec792-6435-4047-bca8-597c104dbc1f
CVE: CVE-2022-1624
Published: 2022-06-13
Description: The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/06e547fd-cddf-4294-87be-54f58d6138a7; https://wpscan.com/vulnerability/06e547fd-cddf-4294-87be-54f58d6138a7
CVE: CVE-2022-1656
Published: 2022-06-13
Description: Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_api_ajax_ actions registered by the JupiterX Core Plugin (<=2.0.6). This includes the ability to deactivate arbitrary plugins as well as update the theme’s API key.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/; https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/
CVE: CVE-2022-1694
Published: 2022-06-13
Description: The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/169a6c81-6c76-4f29-8f60-b2551042b962; https://wpscan.com/vulnerability/169a6c81-6c76-4f29-8f60-b2551042b962
CVE: CVE-2022-1707
Published: 2022-06-13
Description: The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L298; https://github.com/duracelltomi/gtm4wp/blob/1.15/public/frontend.php#L782; https://github.com/duracelltomi/gtm4wp/issues/224
CVE: CVE-2022-1710
Published: 2022-06-13
Description: The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ed162ccc-88e6-41e8-b24d-1b9f77a038b6; https://wpscan.com/vulnerability/ed162ccc-88e6-41e8-b24d-1b9f77a038b6
CVE: CVE-2022-1724
Published: 2022-06-13
Description: The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae; https://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae
CVE: CVE-2022-1756
Published: 2022-06-13
Description: The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072; https://wpscan.com/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072
CVE: CVE-2022-1758
Published: 2022-06-13
Description: The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS as well as RCE when custom code is added via the plugin settings.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/211816ce-d2bc-469b-9a8e-e0c2a5c4461b; https://wpscan.com/vulnerability/211816ce-d2bc-469b-9a8e-e0c2a5c4461b
CVE: CVE-2022-1759
Published: 2022-06-13
Description: The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due to the lack of sanitisation and escaping
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/d8e63f78-f38a-4f68-96ba-8059d175cea8; https://wpscan.com/vulnerability/d8e63f78-f38a-4f68-96ba-8059d175cea8
CVE: CVE-2022-1761
Published: 2022-06-13
Description: The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/31b413e1-d4b5-463e-9[PII_REDACTED]1c062; https://wpscan.com/vulnerability/31b413e1-d4b5-463e-9[PII_REDACTED]1c062
CVE: CVE-2022-1762
Published: 2022-06-13
Description: The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/03254977-37cc-4365-979b-326f9637be85; https://wpscan.com/vulnerability/03254977-37cc-4365-979b-326f9637be85
CVE: CVE-2022-1763
Published: 2022-06-13
Description: Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/bd3aff73-078a-4e5a-b9e3-1604851c6df8; https://wpscan.com/vulnerability/bd3aff73-078a-4e5a-b9e3-1604851c6df8
CVE: CVE-2022-1764
Published: 2022-06-13
Description: The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/04305e4e-37e3-4f35-bf66-3b79b99d2868; https://wpscan.com/vulnerability/04305e4e-37e3-4f35-bf66-3b79b99d2868
CVE: CVE-2022-1765
Published: 2022-06-13
Description: The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks (due to copyright violations or licensing rules).
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/b50e7622-c1dc-485b-a5f5-b010b40eef20; https://wpscan.com/vulnerability/b50e7622-c1dc-485b-a5f5-b010b40eef20
CVE: CVE-2022-1772
Published: 2022-06-13
Description: The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/02addade-d191-4e45-b7b5-2f3f673679ab; https://wpscan.com/vulnerability/02addade-d191-4e45-b7b5-2f3f673679ab
CVE: CVE-2022-1773
Published: 2022-06-13
Description: The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c2cc3d8e-f3ac-46c6-871e-894cf3ba67f6; https://wpscan.com/vulnerability/c2cc3d8e-f3ac-46c6-871e-894cf3ba67f6
CVE: CVE-2022-1777
Published: 2022-06-13
Description: The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://wpscan.com/vulnerability/a50dc7f8-a9e6-41fa-a047-ad1c3bc309b4; https://wpscan.com/vulnerability/a50dc7f8-a9e6-41fa-a047-ad1c3bc309b4
CVE: CVE-2022-1779
Published: 2022-06-13
Description: The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/45117646-88ff-41d4-8abd-e2f18d4b693e; https://wpscan.com/vulnerability/45117646-88ff-41d4-8abd-e2f18d4b693e
CVE: CVE-2022-1780
Published: 2022-06-13
Description: The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/dd22ea1e-49a9-4b06-8dd9-bb224110f98a; https://wpscan.com/vulnerability/dd22ea1e-49a9-4b06-8dd9-bb224110f98a
CVE: CVE-2022-1781
Published: 2022-06-13
Description: The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/7f2ae2c9-57d4-46a0-a9a1-585ec543b153; https://wpscan.com/vulnerability/7f2ae2c9-57d4-46a0-a9a1-585ec543b153
CVE: CVE-2022-1787
Published: 2022-06-13
Description: The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/b85920b3-dfc1-4112-abd8-ce6a5d91ae0d; https://wpscan.com/vulnerability/b85920b3-dfc1-4112-abd8-ce6a5d91ae0d
CVE: CVE-2022-1788
Published: 2022-06-13
Description: Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/c39719e5-dadd-4414-a96d-5e70a1e3d462; https://wpscan.com/vulnerability/c39719e5-dadd-4414-a96d-5e70a1e3d462
CVE: CVE-2022-1790
Published: 2022-06-13
Description: The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/176d5761-4f01-4173-a70c-6052a6a9963e; https://wpscan.com/vulnerability/176d5761-4f01-4173-a70c-6052a6a9963e
CVE: CVE-2022-1791
Published: 2022-06-13
Description: The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/5c185269-cb3a-4463-8d73-b190813d4431; https://wpscan.com/vulnerability/5c185269-cb3a-4463-8d73-b190813d4431
CVE: CVE-2022-1792
Published: 2022-06-13
Description: The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/44555c79-480d-4b6a-9fda-988183c06909; https://wpscan.com/vulnerability/44555c79-480d-4b6a-9fda-988183c06909
CVE: CVE-2022-1793
Published: 2022-06-13
Description: The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://wpscan.com/vulnerability/fd8b84b4-6944-4638-bdc1-1cb6aaabd42c; https://wpscan.com/vulnerability/fd8b84b4-6944-4638-bdc1-1cb6aaabd42c
CVE: CVE-2022-1800
Published: 2022-06-13
Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/4267109c-0ca2-441d-889d-fb39c235f128; https://wpscan.com/vulnerability/4267109c-0ca2-441d-889d-fb39c235f128
CVE: CVE-2022-1814
Published: 2022-06-13
Description: The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b5624fb3-b110-4b36-a00f-20bbc3a8fdb9; https://wpscan.com/vulnerability/b5624fb3-b110-4b36-a00f-20bbc3a8fdb9
CVE: CVE-2022-1822
Published: 2022-06-13
Description: The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2727947%40zephyr-project-manager&new=2727947%40zephyr-project-manager&sfp_email=&sfph_mail=; https://wordpress.org/plugins/zephyr-project-manager/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/22d50526-e21f-412d-9eed-b9b1f48c3358?source=cve
CVE: CVE-2022-1900
Published: 2022-06-13
Description: The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the CopifySettings page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352, CWE-352
References: https://www.wordfence.com/threat-intel/vulnerabilities/id/e92c6374-d11d-458c-b089-0ee79c33e4a6?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1900; https://www.wordfence.com/threat-intel/vulnerabilities/id/e92c6374-d11d-458c-b089-0ee79c33e4a6?source=cve
CVE: CVE-2022-1918
Published: 2022-06-13
Description: The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce validation on the plugin_toolbar_comparte page. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/toolbar-to-share/trunk/toolbartoshare.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/fbda7670-179a-41ed-8ec9-ae7f5102e645?source=cve; https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1918
CVE: CVE-2022-1985
Published: 2022-06-13
Description: The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2736071%40download-manager&new=2736071%40download-manager&sfp_email=&sfph_mail=; https://wordpress.org/plugins/download-manager/#developers; https://www.wordfence.com/blog/2022/06/security-vulnerability-download-manager-plugin/
CVE: CVE-2022-2065
Published: 2022-06-13
Description: Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/neorazorx/facturascripts/commit/1d1edb40b40016d7fd2893b410b98569d7facca1; https://huntr.dev/bounties/bcb44da4-d5c9-4830-924f-02d6defe6506; https://github.com/neorazorx/facturascripts/commit/1d1edb40b40016d7fd2893b410b98569d7facca1
CVE: CVE-2022-2066
Published: 2022-06-13
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/neorazorx/facturascripts/commit/73a6595ca85984d65f656c6356fabb23d1936c54; https://huntr.dev/bounties/da4bbbfd-501f-4c7e-be83-47778103cb59; https://github.com/neorazorx/facturascripts/commit/73a6595ca85984d65f656c6356fabb23d1936c54
CVE: CVE-2022-2067
Published: 2022-06-13
Description: SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/francoisjacquet/rosariosis/commit/15d5e8700d538935b5c411b2a1e25bcf7e16c47c; https://huntr.dev/bounties/a85a53a4-3009-4f41-ac33-8bed8bbe16a8; https://github.com/francoisjacquet/rosariosis/commit/15d5e8700d538935b5c411b2a1e25bcf7e16c47c
CVE: CVE-2022-31041
Published: 2022-06-13
Description: Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20, CWE-434
References: https://github.com/open-formulieren/open-forms/commit/0978a29e821a7228c5d46c0527c3e925eb91b071; https://github.com/open-formulieren/open-forms/security/advisories/GHSA-h85r-xv4w-cg8g; https://github.com/open-formulieren/open-forms/commit/0978a29e821a7228c5d46c0527c3e925eb91b071
CVE: CVE-2022-31398
Published: 2022-06-13
Description: A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://youtu.be/OungdOub18c; https://youtu.be/OungdOub18c
CVE: CVE-2022-31400
Published: 2022-06-13
Description: A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email name field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://youtu.be/uqO6hluHDB4; https://youtu.be/uqO6hluHDB4
CVE: CVE-2022-0209
Published: 2022-06-13
Description: The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/1e4af9be-5c88-4a3e-89ff-dd2b1bc131fe; https://wpscan.com/vulnerability/1e4af9be-5c88-4a3e-89ff-dd2b1bc131fe
CVE: CVE-2022-1654
Published: 2022-06-13
Description: Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/; https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/
CVE: CVE-2022-1657
Published: 2022-06-13
Description: Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterx_cp_load_pane_action AJAX action present in the lib/admin/control-panel/control-panel.php file calls the load_control_panel_pane function. It is possible to use this action to include any local PHP file via the slug parameter. The Jupiter theme has a nearly identical vulnerability which can be exploited via the mka_cp_load_pane_action AJAX action present in the framework/admin/control-panel/logic/functions.php file, which calls the mka_cp_load_pane_action function.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/; https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/