Woody Ad Snippets

3 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2019-16289 MEDIUM POC This Month

The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

XSS WordPress PHP Woody Ad Snippets

NVD

CVSS 3.1

5.4

EPSS

1.0%

CVE-2019-15858 HIGH POC THREAT This Week

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

XSS PHP WordPress RCE Authentication Bypass +1

NVD

CVSS 3.1

8.8

EPSS

20.8%

CVE-2019-14773 HIGH POC This Week

admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PHP WordPress Information Disclosure Woody Ad Snippets

NVD

CVSS 3.0

7.5

EPSS

1.6%

CVE-2019-16289

EPSS 1% CVSS 5.4

MEDIUM POC This Month

XSS WordPress PHP +1

NVD

CVE-2019-15858

EPSS 21% CVSS 8.8

HIGH POC THREAT This Week

XSS PHP WordPress +3

NVD

CVE-2019-14773

EPSS 2% CVSS 7.5

HIGH POC This Week

PHP WordPress Information Disclosure +1

NVD