sodahead vulnerabilities

Products

• luna radio player 1
• sodahead polls 1

Latest sodahead CVEs

Newest publication first

1. CVE-2024-10816 LUNA RADIO PLAYER <= 6.24.01.24 - Unauthenticated Arbitrary File Read

   Published 2024-11-13

   High·CVSS 7.5 EPSS 1.1%

   The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.24.01.24 via the js/fallback.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can con...

2. CVE-2011-5304 SodaHead Polls < 2.0.4 - Multiple Cross-Site Scripting

   Published 2015-01-01

   Medium·CVSS 4.3 EPSS 2.0%

   Multiple cross-site scripting (XSS) vulnerabilities in the Sodahead Polls plugin before 2.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) the poll_id parameter to customizer.php or (2) the customize parameter to poll.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.