Security Vulnerabilities - CVEs Published In August 2019
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
CVSS Score
9.8
EPSS Score
0.089
Published
2019-08-22
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
CVSS Score
6.1
EPSS Score
0.002
Published
2019-08-22
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
CVSS Score
6.1
EPSS Score
0.002
Published
2019-08-22
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
CVSS Score
9.8
EPSS Score
0.01
Published
2019-08-22
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
CVSS Score
7.5
EPSS Score
0.002
Published
2019-08-22
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
CVSS Score
6.1
EPSS Score
0.002
Published
2019-08-22
The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.
CVSS Score
9.8
EPSS Score
0.008
Published
2019-08-22
The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.
CVSS Score
9.8
EPSS Score
0.429
Published
2019-08-22
The tubepress plugin before 1.6.5 for WordPress has XSS.
CVSS Score
6.1
EPSS Score
0.002
Published
2019-08-22
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
CVSS Score
6.1
EPSS Score
0.002
Published
2019-08-22