Extension WordPress
Vulnérabilités StoryChief
Cette page rassemble les failles publiées pour StoryChief, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de StoryChief
3 fiches
StoryChief <= 1.0.42 – Unauthenticated Arbitrary File Upload
The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. This vulnerability occurs through the /wp-json/storychief/webhook REST-API endpoint that does not have sufficient filetype validation. This makes it possible…
*-1.0.42
1.0.43
15/08/2025
StoryChief <= 1.0.30 – Authenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape its StoryChief Key setting before outputting it in an attribute, leading to an Authenticated Stored Cross-Site Scripting issue
*-1.0.30
1.0.31
02/08/2021
StoryChief <= 1.0.30 – Reflected Cross-Site Scripting
The plugin in versions up to 1.0.30 does not sanitise or escape its tab parameter in the Settings page before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue.
*-1.0.30
1.0.31
02/08/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.