acurax vulnerabilities

Products

• Under Construction / Maintenance Mode from Acurax 4
• under construction maintenance mode 4
• floating social media icon 1
• social media widget 1

Latest acurax CVEs

Newest publication first

1. CVE-2024-35749 WordPress Under Construction / Maintenance Mode from Acurax plugin <= 2.6 - IP Bypass vulnerability

   Published 2024-06-10

   Medium·CVSS 5.3 EPSS 0.30%

   Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6.

2. CVE-2024-1476 Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure

   Published 2024-02-28

   Medium·CVSS 5.3 EPSS 0.48%

   The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6 via the REST API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages wh...

3. CVE-2023-6922 Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure

   Published 2024-02-28

   Medium·CVSS 6.5 EPSS 0.49%

   The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.6 via the 'acx_csma_subscribe_ajax' function. This can allow authenticated attackers to extract sensitive data such as na...

4. CVE-2023-39926 WordPress Under Construction / Maintenance Mode from Acurax Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-11-16

   Medium·CVSS 6.1 EPSS 0.41%

   Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Acurax Under Construction / Maintenance Mode from Acurax plugin <= 2.6 versions.

5. CVE-2021-36843 WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

   Published 2021-11-26

   Medium·CVSS 4.8 EPSS 0.57%

   Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.

6. CVE-2018-6357 Social Media Widget by Acurax <= 3.2.5 - Cross-Site Request Forgery leading to Cross-Site Scripting via the recordsArray Parameter

   Published 2018-01-27

   High·CVSS 8.8 EPSS 0.65%

   The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.