Add Any Extension To Pages Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through 1.4.

Affected:

up to 1.5

Fixed in:

1.5

Disclosed:

Dec 28, 2023

CVE-2023-50873 on NVD →

The Add Any Extension to Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'aaetp_options_page' function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a...

CVSS:

4.3

Affected:

up to 1.4

Fixed in:

1.5

Disclosed:

Dec 22, 2023

CVE-2023-50873 on NVD →

The Add Any Extension to Pages plugin for WordPress is vulnerable to Cross-Site Scripting via the 'REQUEST_URI' value in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 1.3

Fixed in:

1.4

Disclosed:

Apr 14, 2017

The Add Any Extension to Pages plugin for WordPress is vulnerable to Cross-Site Scripting via the 'REQUEST_URI' value in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 1.4

Fixed in:

1.4

Disclosed:

Apr 14, 2017

The Add Any Extension to Pages WordPress plugin was affected by a XSS security vulnerability.

Affected:

up to 1.4

Fixed in:

1.4