RSS   Vulnerabilities for 'Wpqa builder'   RSS

2022-06-08
 
CVE-2022-1597

CWE-79
 
 
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks

 
 
CVE-2022-1598

CWE-284
 
 
The WPQA Builder WordPress plugin before 5.4 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.

 
2022-05-16
 
CVE-2022-1051

CWE-79
 
 
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to perform Cross-Site Scripting attacks.

 
 
CVE-2022-1349

CWE-287
 
 
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.

 
 
CVE-2022-1425

CWE-639
 
 
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.

 

 >>> Vendor: 2code 3 Products
Wpqa builder
Ask me
Discy

Copyright 2024, cxsecurity.com

 

Back to Top