Holest
Monthly
Privilege escalation to administrator in the Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light WordPress plugin (all versions through 2.4.37) lets unauthenticated attackers create new admin accounts through the unprotected user_filter function. Because no capability or nonce check gates the routine, any remote visitor can seize full control of the WordPress site, making this a critical site-takeover flaw; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Privilege escalation to administrator in the Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light WordPress plugin (all versions through 2.4.37) lets unauthenticated attackers create new admin accounts through the unprotected user_filter function. Because no capability or nonce check gates the routine, any remote visitor can seize full control of the WordPress site, making this a critical site-takeover flaw; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.