Teconcetheme
Monthly
Unauthenticated SQL injection in the Nikstore Core WordPress plugin (versions <= 1.5) lets remote attackers inject arbitrary SQL through unsanitized input reaching a database query, per a Patchstack report classified under CWE-89. Any exposed WordPress site running the plugin is reachable without credentials, and the changed CVSS scope reflects the database being a distinct security authority from the web application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Missing authorization in the Mayosis Core WordPress plugin (versions through 5.4.7) by TeconceTheme allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized modification of data (integrity impact). The CVSS vector confirms no authentication or user interaction is required, and the vulnerability is network-exploitable against default configurations. No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Unauthenticated SQL injection in the Nikstore Core WordPress plugin (versions <= 1.5) lets remote attackers inject arbitrary SQL through unsanitized input reaching a database query, per a Patchstack report classified under CWE-89. Any exposed WordPress site running the plugin is reachable without credentials, and the changed CVSS scope reflects the database being a distinct security authority from the web application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Missing authorization in the Mayosis Core WordPress plugin (versions through 5.4.7) by TeconceTheme allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized modification of data (integrity impact). The CVSS vector confirms no authentication or user interaction is required, and the vulnerability is network-exploitable against default configurations. No public exploit code exists and no active exploitation has been confirmed at time of analysis.