Cybernetikz Easy Social Icons vulnerabilities
6 known vulnerabilities affecting cybernetikz/easy_social_icons.
Total CVEs
6
CISA KEV
0
Public exploits
2
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM5
Vulnerabilities
Page 1 of 1
CVE-2021-39322P3MEDIUMCVSS 6.1PoCfixed in 3.0.9≥ 3.0.8, ≤ 3.0.82021-09-02
CVE-2021-39322 [MEDIUM] CWE-79 CVE-2021-39322: The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF'
The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
nvd
CVE-2015-2084P4MEDIUMCVSS 6.8PoC≤ 1.2.22015-02-25
CVE-2015-2084 [MEDIUM] CWE-352 CVE-2015-2084: Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for Wor
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php.
nvd
CVE-2022-0887P3HIGHCVSS 7.2fixed in 3.1.42022-04-04
CVE-2022-0887 [HIGH] CWE-89 CVE-2022-0887: The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute t
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
nvd
CVE-2023-48336P4MEDIUMCVSS 5.4≤ 3.2.4≥ n/a, ≤ 3.2.42023-11-30
CVE-2023-48336 [MEDIUM] CWE-79 CVE-2023-48336: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybernetikz Easy Social Icons allows Stored XSS.This issue affects Easy Social Icons: from n/a through 3.2.4.
nvd
CVE-2023-33998P4MEDIUMCVSS 4.3≥ n/a, ≤ 3.2.52024-12-13
CVE-2023-33998 [MEDIUM] CWE-862 CVE-2023-33998: Missing Authorization vulnerability in cybernetikz Easy Social Icons allows Exploiting Incorrectly C
Missing Authorization vulnerability in cybernetikz Easy Social Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Icons: from n/a through 3.2.5.
nvd
CVE-2022-0840P4MEDIUMCVSS 4.8fixed in 3.2.12022-04-11
CVE-2022-0840 [MEDIUM] CWE-79 CVE-2022-0840: The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field wh
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
nvd