themeisle Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts vulnerabilities

Latest themeisle Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts CVEs

Newest publication first

1. CVE-2024-3105 Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution

   Published 2024-06-15

   Critical·CVSS 9.9 EPSS 2.8%

   The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...

2. CVE-2020-36759 Woody code snippets <= 2.3.9 - Cross-Site Request Forgery Bypass

   Published 2023-10-20

   Medium·CVSS 4.3 EPSS 0.48%

   The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate an...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.