Advanced Text Widget Vulnerabilities

[en] Missing Authorization vulnerability in Max Chirkov Advanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Text Widget : from n/a through 2.1.2.

Affected:

up to 2.1.2

Fix:

No patched version reported

Disclosed:

Dec 9, 2024

CVE-2023-26520 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Chirkov Advanced Text Widget plugin <= 2.1.2 versions.

Affected:

up to 2.1.2

Fix:

No patched version reported

Disclosed:

Jun 22, 2023

CVE-2023-26539 on NVD →

The Advanced Text Widget plugin for WordPress is vulnerable to unauthorized admin notice dismisssal due to a missing capability check on the atw_dismiss_admin_notice function in versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to dismiss admin notices.

CVSS:

5.3

Affected:

up to 2.1.2

Fix:

No patched version reported

Disclosed:

Feb 28, 2023

CVE-2023-26520 on NVD →

The Advanced Text Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject...

CVSS:

4.4

Affected:

up to 2.1.2

Fix:

No patched version reported

Disclosed:

Feb 28, 2023

CVE-2023-26539 on NVD →

[en] Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

Affected:

up to 2.1

Fixed in:

2.1

Disclosed:

Jan 24, 2013

CVE-2011-4618 on NVD →

Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

CVSS:

6.1

Affected:

up to 2.0.1

Fixed in:

2.0.2

Disclosed:

Nov 21, 2012

CVE-2011-4618 on NVD →

The Advanced Text Widget WordPress plugin was affected by a Cross Site Scripting security vulnerability.

Affected:

up to 2.0.2

Fixed in:

2.0.2