Wow-company

Wp Coder

6 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.1

CVE-2025-24699

  • EPSS 0.03%
  • Published 14.02.2025 13:15:50
  • Last modified 14.02.2025 13:15:50

Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder allows Cross-Site Scripting (XSS). This issue affects WP Coder: from n/a through 3.6.

4.8

CVE-2024-2578

  • EPSS 0.12%
  • Published 21.03.2024 17:15:09
  • Last modified 09.04.2025 15:41:12

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.

6.1

CVE-2023-2362

Exploit
  • EPSS 0.12%
  • Published 12.06.2023 18:15:09
  • Last modified 05.05.2025 16:15:35

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button Word...

4.9

CVE-2023-0895

  • EPSS 0.29%
  • Published 17.02.2023 17:15:11
  • Last modified 21.11.2024 07:38:03

The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of suff...

6.5

CVE-2022-2388

Exploit
  • EPSS 0.14%
  • Published 22.08.2022 15:15:14
  • Last modified 21.11.2024 07:00:53

The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack

8.8

CVE-2021-25053

Exploit
  • EPSS 0.11%
  • Published 10.01.2022 16:15:09
  • Last modified 21.11.2024 05:54:15

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.