Extension WordPress
Vulnérabilités MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
Cette page rassemble les failles publiées pour MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
13 fiches
Multiple Page Generator Plugin – MPG <= 4.0.5 – Authenticated (Editor+) Server-Side Request Forgery via fileUrl
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpg_download_file_by_link' function. This makes it possible for authenticated attackers, with editor-level access…
*-4.0.5
4.0.6
25/01/2025
Multiple Page Generator Plugin – MPG <= 4.0.2 – Authenticated (Editor+) Directory Traversal to Limited File Deletion
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upsert_project_source_block() function in all versions up to, and including, 4.0.2. This makes it possible…
*-4.0.2
4.0.3
11/11/2024
Multiple Page Generator Plugin – MPG <= 4.0.1 – Missing Authorization
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This…
*-4.0.1
4.0.2
31/10/2024
Multiple Page Generator Plugin – MPG <= 3.4.7 – Authenticated (Contributor+) SQL Injection
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
*-3.4.7
3.4.8
25/09/2024
Multiple Page Generator Plugin – MPG <= 3.4.0 – Cross-Site Request Forgery
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the delete_project action. This makes…
*-3.4.0
3.4.1
05/04/2024
Multiple Page Generator Plugin – MPG <= 3.4.0 – Missing Authorization via mpg_get_log_by_project_id
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mpg_get_log_by_project_id' function in versions up to, and including, 3.4.0. This makes it possible…
*-3.4.0
3.4.1
26/03/2024
Multiple Page Generator Plugin – MPG <= 3.4.0 – Authenticated (Editor+) Remote Code Execution
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with editor-level access and above, to execute…
*-3.4.0
3.4.1
13/03/2024
ThemeIsle SDK <= Various Versions – Missing Authorization
Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to…
*-3.4.0
3.4.1
01/02/2024
Freemius SDK <= 2.5.9 – Reflected Cross-Site Scripting via fs_request_get
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
*-2.8.12
3.0.0
18/07/2023
Multiple Page Generator Plugin – MPG <= 3.3.19 – Authenticated (Administrator+) SQL Injection in projects_list and total_projects
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to SQL Injection in the projects_list and total_projects functions in versions up to, and including, 3.3.19 due to insufficient escaping on a user supplied parameter and…
*-3.3.19
3.3.20
23/05/2023
Multiple Page Generator Plugin <= 3.3.17 – Cross-Site Request Forgery to SQL Injection
The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the…
*-3.3.17
3.3.18
16/05/2023
Multiple Page Generator Plugin <= 3.3.17 – Authenticated (Administrator+) SQL Injection
The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of…
*-3.3.17
3.3.18
16/05/2023
Multiple Page Generator Plugin <= 3.3.9 – Cross-Site Request Forgery
The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.9. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated…
*-3.3.9
3.3.10
20/02/2023
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.