Delower

Wp To Do

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.8

CVE-2024-3944

  • EPSS 0.19%
  • Veröffentlicht 29.08.2024 11:15:26
  • Zuletzt bearbeitet 04.10.2024 13:19:51

The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

5.4

CVE-2024-37539

  • EPSS 0.14%
  • Veröffentlicht 06.07.2024 13:15:10
  • Zuletzt bearbeitet 21.11.2024 09:24:02

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.3.0.

4.3

CVE-2024-3943

  • EPSS 0.18%
  • Veröffentlicht 30.05.2024 05:15:55
  • Zuletzt bearbeitet 12.02.2025 16:26:27

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_addcomment function. This makes it possible for unauthentica...

4.3

CVE-2024-3945

  • EPSS 0.18%
  • Veröffentlicht 30.05.2024 05:15:55
  • Zuletzt bearbeitet 12.02.2025 16:26:04

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_manage() function. This makes it possible for unauthenticate...

4.8

CVE-2024-3946

  • EPSS 0.28%
  • Veröffentlicht 30.05.2024 05:15:55
  • Zuletzt bearbeitet 12.02.2025 16:25:25

The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

4.3

CVE-2024-3947

  • EPSS 0.18%
  • Veröffentlicht 30.05.2024 05:15:55
  • Zuletzt bearbeitet 12.02.2025 16:23:45

The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_settings() function. This makes it possible for unauthentica...

5.4

CVE-2024-22292

  • EPSS 0.07%
  • Veröffentlicht 31.01.2024 18:15:49
  • Zuletzt bearbeitet 21.11.2024 08:55:58

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.2.8.