webdorado vulnerabilities

Products

• SpiderVPlayer 2
• WDSocialWidgets 2
• spider video player 1
• SpiderFAQ 1

Latest webdorado CVEs

Newest publication first

1. CVE-2024-31123 WordPress SpiderFAQ plugin <= 1.3.2 - Cross Site Scripting vulnerability

   Published 2024-03-31

   High·CVSS 7.1 EPSS 0.35%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebDorado SpiderFAQ allows Reflected XSS.This issue affects SpiderFAQ: from n/a through 1.3.2.

2. CVE-2023-48320 WordPress Video Player Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-11-30

   Medium·CVSS 4.8 EPSS 0.39%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebDorado SpiderVPlayer allows Stored XSS.This issue affects SpiderVPlayer: from n/a through 1.5.22.

3. CVE-2023-46619 WordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-11-13

   High·CVSS 8.8 EPSS 0.30%

   Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.

4. CVE-2023-46090 WordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-10-26

   Medium·CVSS 6.1 EPSS 0.37%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.

5. CVE-2023-45632 WordPress Video Player Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-10-18

   Medium·CVSS 6.1 EPSS 0.38%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions.

6. CVE-2013-3532 SpiderVPlayer <= 2.1 - SQL Injection

   Published 2013-05-10

   High·CVSS 7.5 EPSS 5.4% Public exploit

   SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.