zemanta vulnerabilities

Products

• related posts 3
• search everything 2
• Editorial Assistant by Sovrn 1

Latest zemanta CVEs

Newest publication first

1. CVE-2024-9626 Editorial Assistant by Sovrn <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image

   Published 2024-10-26

   Medium·CVSS 4.3 EPSS 0.28%

   The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta_set_featured_image' function in versions up to, and including, 1.3.3. This makes it possible for authenticated attackers...

2. CVE-2013-3476 Related Posts < 2.7.2 - Cross-Site Request Forgery

   Published 2014-06-02

   Medium·CVSS 6.8 EPSS 1.1%

   Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin before 2.6.2 for WordPress allows remote attackers to hijack the authentication of users for requests that change settings via unspecified vectors.

3. CVE-2013-3257 Related Posts < 2.7.2 - Cross-Site Request Forgery

   Published 2014-06-02

   Medium·CVSS 6.8 EPSS 1.1%

   Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings via unspecified vectors.

4. CVE-2013-3477 Related Posts by Zemanta <= 1.3.1 - Cross-Site Request Forgery

   Published 2014-05-27

   Medium·CVSS 6.8 EPSS 1.1%

   Cross-site request forgery (CSRF) vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change settings via unknown vectors.

5. CVE-2014-3843 Search Everything <= 8.1 - Cross-Site Request Forgery

   Published 2014-05-22

   Medium·CVSS 6.8 EPSS 0.95%

   Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

6. CVE-2014-2316 Search Everything <= 7.0.2 - SQL Injection

   Published 2014-03-07

   High·CVSS 7.5 EPSS 2.2%

   SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.