Wpwebinfotech Social Auto Poster vulnerabilities

CVE-2024-6753 [MEDIUM] CWE-79 CVE-2024-6753: The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ma The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbit

CVE-2024-6756 [HIGH] CVE-2024-6756: The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing f The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above permissions, to upload arbitrary files on the affected site's s

CVE-2024-6750 [HIGH] CWE-862 CVE-2024-6750: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.

CVE-2024-49272 [HIGH] CWE-352 CVE-2024-49272: Cross-Site Request Forgery (CSRF) vulnerability in wpweb Social Auto Poster social-auto-poster allow Cross-Site Request Forgery (CSRF) vulnerability in wpweb Social Auto Poster social-auto-poster allows Cross Site Request Forgery.This issue affects Social Auto Poster: from n/a through <= 5.3.15.

CVE-2024-6751 [MEDIUM] CWE-352 CVE-2024-6751: The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.

CVE-2024-6755 [MEDIUM] CWE-862 CVE-2024-6755: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of d The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_poster_quick_delete_multiple’ function in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to delete arbitrary posts.

CVE-2024-47369 [MEDIUM] CWE-79 CVE-2024-47369: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweb Social Auto Poster social-auto-poster allows Reflected XSS.This issue affects Social Auto Poster: from n/a through <= 5.3.15.

CVE-2024-6752 [MEDIUM] CWE-79 CVE-2024-6752: The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-l

CVE-2024-6754 [MEDIUM] CWE-862 CVE-2024-6754: The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata.