Unitedover Digits vulnerabilities
2 known vulnerabilities affecting unitedover/digits.
Total CVEs
2
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH1
Vulnerabilities
Page 1 of 1
CVE-2025-4094P2CRITICALCVSS 9.8PoCfixed in 8.4.6.12025-05-21
CVE-2025-4094 [CRITICAL] CWE-307 CVE-2025-4094: The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate l
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
nvd
CVE-2024-0203P3HIGHCVSS 8.8≤ 8.4.22024-03-07
CVE-2024-0203 [HIGH] CWE-352 CVE-2024-0203: The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i
The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing nonce validation in the 'digits_save_settings' function. This makes it possible for unauthenticated attackers to modify the default role of registered users to elevate user privileges via a forged request granted th
nvd