360Deg Javascript Viewer Vulnerabilities

[en] The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject...

Affected:

up to 1.7.30

Fixed in:

1.7.30

Disclosed:

Dec 12, 2024

CVE-2024-12271 on NVD →

The 360 Javascript Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ref’ parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbi...

CVSS:

4.4

Affected:

up to 1.7.29

Fixed in:

1.7.30

Disclosed:

Dec 11, 2024

CVE-2024-12271 on NVD →

[en] Missing Authorization vulnerability in 360 Javascript Viewer 360 Javascript Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 360 Javascript Viewer: from n/a through 1.7.11.

Affected:

up to 1.7.12

Fixed in:

1.7.12

Disclosed:

Dec 9, 2024

CVE-2023-48779 on NVD →

[en] The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to updat...

Affected:

up to 1.7.13

Fixed in:

1.7.13

Disclosed:

Apr 9, 2024

CVE-2024-1637 on NVD →

The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to update plu...

CVSS:

4.3

Affected:

up to 1.7.12

Fixed in:

1.7.13

Disclosed:

Mar 21, 2024

CVE-2024-1637 on NVD →

The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveSettings() function hooked via a norpriv AJAX in versions up to, and including, 1.7.11. This makes it possible for unauthenticated attackers to modify the plugin's settings.

CVSS:

5.3

Affected:

up to 1.7.11

Fixed in:

1.7.12

Disclosed:

Nov 28, 2023

CVE-2023-48779 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 1.5.3

Fixed in:

1.5.3

CVE-2023-33999 on NVD →