Extension WordPress
Vulnérabilités WP Cerber Security, Anti-spam & Malware Scan
Cette page rassemble les failles publiées pour WP Cerber Security, Anti-spam & Malware Scan, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WP Cerber Security, Anti-spam & Malware Scan
9 fiches
WP Cerber Security <= 9.4 – IP Protection Bypass
The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass in versions up to, and including 9.4 due to the plugin improperly checking for a visitor's IP address. This makes it possible for an attacker…
*-9.4
9.5
30/08/2024
WP Cerber Security <= 9.1 – Unauthenticated Stored Cross-Site Scripting
The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, and including, 9.1. This makes it possible for unauthenticated attackers to…
*-9.1
9.2
19/04/2023
WP Cerber Security <= 9.3.2 – User Enumeration Bypass via REST API
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.3.2, that makes user enumeration possible via the REST API. This is due the plugin not blocking access to…
*-9.3.2
9.3.3
12/12/2022
WP Cerber Security <= 9.0 – User Enumeration Bypass
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author'…
*-9.0
9.1
02/09/2022
WP Cerber Security <= 9.0 – Authenticated (Admin+) Stored Cross-Site Scripting
The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the 'add_acl_comment' parameter. This makes it possible for authenticated attackers with administrator-level permissions to inject arbitrary web scripts in pages that will execute whenever…
*-9.0
9.1
22/08/2022
WP Cerber Security <= 8.9.5.2 – Unauthenticated Stored Cross-Site Scripting
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site…
*-8.9.5.2
8.9.6
14/02/2022
WP Cerber < 8.9.3 – Access Bypass Control
WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character.
[*, 8.9.3)
8.9.3
16/08/2021
WP Cerber Security < 8.9.3 – Multifactor Bypass
WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.
[*, 8.9.3)
8.9.3
16/08/2021
Cerber Security, Anti-spam & Malware Scan < 2.7 – Stored Cross-Site Scripting
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header when "I'm behind a proxy" option is enabled.
[*, 2.7)
2.7
01/04/2016
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.