Keywordrush
Monthly
Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the `img_file` field within `cegg_data` post metadata is sanitized only with `wp_strip_all_tags()` - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside `getFullImgPath()` (ImageHelper.php:L149) before being passed to PHP's `unlink()`. Deletion of critical WordPress files such as `wp-config.php` can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the `img_file` field within `cegg_data` post metadata is sanitized only with `wp_strip_all_tags()` - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside `getFullImgPath()` (ImageHelper.php:L149) before being passed to PHP's `unlink()`. Deletion of critical WordPress files such as `wp-config.php` can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.