Webcraftic vulnerabilities

Products

• woody ad snippets 4
• Hide login page 1
• simple 301 redirects 1
• simple 301 redirects-addon-bulk uploader 1

Latest Webcraftic CVEs

Newest publication first

1. CVE-2024-3105 Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution

   Published 2024-06-15

   Critical·CVSS 9.9 EPSS 2.8%

   The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...

2. CVE-2023-48335 WordPress Hide login page plugin <= 1.1.9 - Secret Login Page Location Disclosure on Multisites vulnerability

   Published 2024-06-04

   Low·CVSS 3.7 EPSS 0.30%

   Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Webcraftic Hide login page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hide login page: from n/a through 1.1.9.

3. CVE-2019-16289 Woody Ad Snippets <= 2.2.8 - Authenticated Cross-Site Scripting

   Published 2019-09-13

   Medium·CVSS 5.4 EPSS 1.0%

   The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.

4. CVE-2019-15858 Woody Ad Snippets <= 2.2.4 - Missing Authorization to Settings Import

   Published 2019-09-03

   High·CVSS 8.8 EPSS 20.0%

   admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.

5. CVE-2019-15818 Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Missing Authentication on Option Changes

   Published 2019-08-30

   Medium·CVSS 6.1 EPSS 1.5%

   The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.

6. CVE-2019-15776 Simple 301 Redirects Addon Bulk Uploader <= 1.2.4 - Missing Authorization

   Published 2019-08-29

   Medium·CVSS 6.1 EPSS 1.3%

   The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.

7. CVE-2019-14773 Woody Ad Snippets <= 2.2.5 - Arbitrary Post Deletion

   Published 2019-08-08

   High·CVSS 7.5 EPSS 1.6%

   admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.