Extension WordPress
Vulnérabilités Futurio Extra
Cette page rassemble les failles publiées pour Futurio Extra, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Futurio Extra
8 fiches
Futurio Extra <= 2.0.14 – Authenticated (Contributor+) Stored Cross-Site Scripting via header_size tag
The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and…
*-2.0.14
2.0.15
02/12/2024
Futurio Extra <= 2.0.13 – Authenticated (Contributor+) Post Disclosure
The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for…
*-2.0.13
2.0.14
11/11/2024
Futurio Extra <= 2.0.11 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and…
*-2.0.11
2.0.12
24/10/2024
Futurio Extra <= 2.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget
The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping.…
*-2.0.5
2.0.6
11/06/2024
Futurio Extra <= 1.8.2 – Cross-Site Request Forgery via 'futurio_extra_reset_mod'
The Futurio Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to missing or incorrect nonce validation on the 'futurio_extra_reset_mod' function. This makes it possible for unauthenticated…
*-1.8.2
1.8.3
11/08/2023
Futurio Extra <= 1.9.0 – Cross-Site Request Forgery
The Futurio Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on the futurio_ajax_required_plugins_activate function. This makes it possible for unauthenticated…
*-1.9.0
1.9.1
11/08/2023
Futurio Extra <= 1.6.2 – Sensitive Information Disclosure
The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address.
[*, 1.6.3)
1.6.3
14/01/2022
Futurio Extra <= 1.6.2 – Authenticated (Admin+) SQL Injection
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against…
[*, 1.6.3)
1.6.3
04/01/2022
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.