Ebook Store
Monthly
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no credentials and no user interaction, with the impact limited to unauthorized integrity modifications - no data disclosure or availability impact is indicated. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data. The flaw stems from missing capability verification (CWE-862) on one or more plugin endpoints, allowing any internet-accessible WordPress installation running this plugin to leak limited confidential information without credentials. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded by a low confidentiality rating with no integrity or availability consequence.
The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and including, 5.8001 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in motov.net Ebook Store ebook-store allows Exploiting Incorrectly Configured Access Control Security Levels.775. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shopfiles Ltd Ebook Store allows Stored XSS.788. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sensitive data exposure in the Ebook Store plugin for WordPress versions 6.19 and below allows unauthenticated remote attackers to access confidential information via missing authorization checks. The vulnerability, reported by Patchstack, affects installations of the plugin where the default, unauthenticated endpoint is exposed, leading to high confidentiality impact. No public exploit or active exploitation has been identified at this time.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no credentials and no user interaction, with the impact limited to unauthorized integrity modifications - no data disclosure or availability impact is indicated. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data. The flaw stems from missing capability verification (CWE-862) on one or more plugin endpoints, allowing any internet-accessible WordPress installation running this plugin to leak limited confidential information without credentials. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded by a low confidentiality rating with no integrity or availability consequence.
The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'step' parameter in all versions up to, and including, 5.8001 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ebook Store plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including,. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in motov.net Ebook Store ebook-store allows Exploiting Incorrectly Configured Access Control Security Levels.775. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shopfiles Ltd Ebook Store allows Stored XSS.788. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.