Wow-Company: Security Vulnerabilities
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
CVSS Score
8.8
EPSS Score
0.001
Published
2022-01-10
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.
CVSS Score
8.8
EPSS Score
0.007
Published
2022-01-10
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection
CVSS Score
7.2
EPSS Score
0.009
Published
2021-11-08
Page 5