Wp Coder
Monthly
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.5. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WP Coder - add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.5. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WP Coder - add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.