Inisev
Monthly
Unauthenticated cross-site scripting in the WordPress plugin Social Share Icons & Social Share Buttons (versions <= 3.7.5) lets remote attackers inject script that executes in the browser of a site visitor or administrator who interacts with the crafted content, scoring CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the plugin is embedded on public-facing WordPress pages, any site running an affected version is exposed, and per the CVSS vector the attacker needs no credentials (PR:N) but must convince a victim to take an action such as clicking a crafted link (UI:R), with the scope change (S:C) meaning the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no vendor-released patch version documented in the available references, so sites should treat the plugin's 3.7.5 release line as vulnerable until a fixed version is published.
Unauthenticated cross-site scripting in the Social Media & Share Icons WordPress plugin (by Inisev, versions ≤ 2.9.9) allows remote attackers to inject arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS scope change (S:C) indicates injected scripts can breach the plugin's own security boundary, enabling session hijacking, credential theft, or page defacement against site visitors and administrators. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the zero-authentication requirement substantially lowers the exploitation bar.
OS command injection in the Backup Migration WordPress plugin (all versions through 2.1.5.1) allows authenticated attackers holding Administrator-level access - or any user granted the plugin's custom `do_backups` capability - to execute arbitrary operating-system commands as the web-server user. The flaw stems from misuse of `esc_attr()`, an HTML sanitizer, as a shell sanitizer in the `restoreBackup()` AJAX handler, enabling shell metacharacter injection into an `exec()` call. This represents an incomplete remediation of CVE-2023-7002; the equivalent fix applied to `handleQuickMigration()` was never ported to the `$backupName` variable path. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated sensitive data exposure in the Inisev Backup Migration WordPress plugin (versions through 2.1.1) allows remote attackers to retrieve confidential information without credentials or user interaction. Patchstack rates the issue at CVSS 7.5 with high confidentiality impact; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Broken authorization in the Copy & Delete Posts WordPress plugin through 1.5.4 lets any authenticated user assigned a plugin-enabled (non-admin) role invoke every operation exposed by the cdp_action_handling AJAX endpoint, enabling post deletion and plugin-setting tampering. The flaw stems from a missing per-function capability check that the dispatcher should enforce based on the f parameter. No public exploit identified at time of analysis and the CVE is not on CISA KEV.
Stored cross-site scripting in the WordPress plugin Duplicate Post (copy-delete-posts) through version 1.5.6 lets an authenticated subscriber-level user inject arbitrary JavaScript via the 'noti_token' parameter, which then executes in the browser of anyone who later views the affected page. Exploitation is not unconditional: the site owner must have enabled the plugin's User Level Permissions for the Subscriber role, a non-default setting that exposes the i_saw_this_noti AJAX branch used to deliver the payload, so default installations are not reachable by low-privilege users. No public exploit code has been identified at time of analysis, and no KEV listing applies, though the stored nature of the flaw means a single successful injection can affect privileged administrators and visitors; the vendor has released version 1.5.7 as the fix.
Reflected cross-site scripting in the WordPress plugin Social Media Share Buttons & Social Sharing Icons (slug ultimate-social-media-icons, vendor inisev) affects all versions up to and including 3.0.1, allowing an unauthenticated attacker to inject script into a crafted URL that executes in the browser of a victim who opens it and triggers the plugin's WeChat share dialog. Exploitation is gated by two conditions baked into the vulnerable path: the victim must be browsing with a mobile user-agent and must click the WeChat share icon, after which the injected script runs automatically without further interaction (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the practical risk is lower than the unauthenticated network framing suggests because of the mobile-agent and share-click preconditions.
: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.8.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated attackers can trigger backup upload queue processing in Backup Migration plugin for WordPress (all versions up to 2.0.0) via the 'initializeOfflineAjax' AJAX endpoint, which lacks capability checks and relies on publicly exposed hardcoded tokens for validation. This allows remote attackers to cause unexpected backup transfers to cloud storage and resource exhaustion without authentication or user interaction. CVSS 5.3 (medium), no confirmed active exploitation reported.
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Social Media & Share Icons allows Stored XSS.9.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated cross-site scripting in the WordPress plugin Social Share Icons & Social Share Buttons (versions <= 3.7.5) lets remote attackers inject script that executes in the browser of a site visitor or administrator who interacts with the crafted content, scoring CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the plugin is embedded on public-facing WordPress pages, any site running an affected version is exposed, and per the CVSS vector the attacker needs no credentials (PR:N) but must convince a victim to take an action such as clicking a crafted link (UI:R), with the scope change (S:C) meaning the injected script can affect resources beyond the vulnerable component. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no vendor-released patch version documented in the available references, so sites should treat the plugin's 3.7.5 release line as vulnerable until a fixed version is published.
Unauthenticated cross-site scripting in the Social Media & Share Icons WordPress plugin (by Inisev, versions ≤ 2.9.9) allows remote attackers to inject arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS scope change (S:C) indicates injected scripts can breach the plugin's own security boundary, enabling session hijacking, credential theft, or page defacement against site visitors and administrators. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the zero-authentication requirement substantially lowers the exploitation bar.
OS command injection in the Backup Migration WordPress plugin (all versions through 2.1.5.1) allows authenticated attackers holding Administrator-level access - or any user granted the plugin's custom `do_backups` capability - to execute arbitrary operating-system commands as the web-server user. The flaw stems from misuse of `esc_attr()`, an HTML sanitizer, as a shell sanitizer in the `restoreBackup()` AJAX handler, enabling shell metacharacter injection into an `exec()` call. This represents an incomplete remediation of CVE-2023-7002; the equivalent fix applied to `handleQuickMigration()` was never ported to the `$backupName` variable path. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated sensitive data exposure in the Inisev Backup Migration WordPress plugin (versions through 2.1.1) allows remote attackers to retrieve confidential information without credentials or user interaction. Patchstack rates the issue at CVSS 7.5 with high confidentiality impact; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Broken authorization in the Copy & Delete Posts WordPress plugin through 1.5.4 lets any authenticated user assigned a plugin-enabled (non-admin) role invoke every operation exposed by the cdp_action_handling AJAX endpoint, enabling post deletion and plugin-setting tampering. The flaw stems from a missing per-function capability check that the dispatcher should enforce based on the f parameter. No public exploit identified at time of analysis and the CVE is not on CISA KEV.
Stored cross-site scripting in the WordPress plugin Duplicate Post (copy-delete-posts) through version 1.5.6 lets an authenticated subscriber-level user inject arbitrary JavaScript via the 'noti_token' parameter, which then executes in the browser of anyone who later views the affected page. Exploitation is not unconditional: the site owner must have enabled the plugin's User Level Permissions for the Subscriber role, a non-default setting that exposes the i_saw_this_noti AJAX branch used to deliver the payload, so default installations are not reachable by low-privilege users. No public exploit code has been identified at time of analysis, and no KEV listing applies, though the stored nature of the flaw means a single successful injection can affect privileged administrators and visitors; the vendor has released version 1.5.7 as the fix.
Reflected cross-site scripting in the WordPress plugin Social Media Share Buttons & Social Sharing Icons (slug ultimate-social-media-icons, vendor inisev) affects all versions up to and including 3.0.1, allowing an unauthenticated attacker to inject script into a crafted URL that executes in the browser of a victim who opens it and triggers the plugin's WeChat share dialog. Exploitation is gated by two conditions baked into the vulnerable path: the victim must be browsing with a mobile user-agent and must click the WeChat share icon, after which the injected script runs automatically without further interaction (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the practical risk is lower than the unauthenticated network framing suggests because of the mobile-agent and share-click preconditions.
: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.8.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated attackers can trigger backup upload queue processing in Backup Migration plugin for WordPress (all versions up to 2.0.0) via the 'initializeOfflineAjax' AJAX endpoint, which lacks capability checks and relies on publicly exposed hardcoded tokens for validation. This allows remote attackers to cause unexpected backup transfers to cloud storage and resource exhaustion without authentication or user interaction. CVSS 5.3 (medium), no confirmed active exploitation reported.
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Inisev Social Media & Share Icons allows Stored XSS.9.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.