Xwp
Monthly
Authorization bypass in the Stream - Activity Log & Audit Trail WordPress plugin (versions through 4.2.0) exposes the full site audit trail to any authenticated user holding a subscriber-level account or higher. The flaw resides in the plugin's Heartbeat API live-update handler, which returns activity records without verifying the requesting user holds the privileges required to view them (CWE-862). No public exploit or CISA KEV listing exists at time of analysis, but the low exploitation bar - any registered user account suffices - makes this a credible insider or low-effort attacker risk on sites with open registration.
The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.9.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Authorization bypass in the Stream - Activity Log & Audit Trail WordPress plugin (versions through 4.2.0) exposes the full site audit trail to any authenticated user holding a subscriber-level account or higher. The flaw resides in the plugin's Heartbeat API live-update handler, which returns activity records without verifying the requesting user holds the privileges required to view them (CWE-862). No public exploit or CISA KEV listing exists at time of analysis, but the low exploitation bar - any registered user account suffices - makes this a credible insider or low-effort attacker risk on sites with open registration.
The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.9.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.