Extension WordPress
Vulnérabilités EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents, page 2
Cette page rassemble les failles publiées pour EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
31 fiches
EmbedPress <= 3.9.8 – Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Calendar Widget Link in all versions…
*-3.9.8
3.9.9
14/02/2024
EmbedPress <= 3.9.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to,…
*-3.9.8
3.9.9
14/02/2024
EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's embed_oembed_html shortcode in all versions up…
[*, 3.9.5)
3.9.6
02/01/2024
EmbedPress <= 3.9.4 – Missing Authorization
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_source_data()…
[*, 3.9.5)
3.9.5
08/12/2023
EmbedPress <= 3.9.1 – Reflected Cross-Site Scripting
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'password' parameter in all versions up to,…
*-3.9.1
3.9.2
17/11/2023
EmbedPress <= 3.9.1 – Reflected Cross-Site Scripting
The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the hash parameter in all versions up to,…
*-3.9.1
3.9.2
17/11/2023
EmbedPress <= 3.8.3 – Cross-Site Request Forgery
The EmbedPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8.3. This is due to missing nonce validation on the clicked() function. This makes it possible for unauthenticated attackers to trigger…
[*, 3.8.4)
3.8.4
07/09/2023
EmbedPress <= 3.8.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible…
*-3.8.2
3.8.3
09/08/2023
EmbedPress <= 3.8.2 – Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data
The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers…
*-3.8.2
3.8.3
09/08/2023
Freemius SDK <= 2.5.9 – Reflected Cross-Site Scripting via fs_request_get
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
*-2.0.2
2.0.3
18/07/2023
EmbedPress <= 3.7.3 – Sensitive Information Exposure
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt…
*-3.7.3
3.8.0
26/06/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.