Authldap Vulnerabilities

The authLdap plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.8. This is due to missing or incorrect nonce validation on the authLdap_options_panel() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request...

CVSS:

4.3

Affected:

up to 2.5.8

Fixed in:

2.5.9

Disclosed:

Sep 1, 2023

CVE-2023-41654 on NVD →

The authLdap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings in versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary...

CVSS:

3.3

Affected:

up to 2.6.1

Fixed in:

2.6.2

Disclosed:

Sep 1, 2023

CVE-2023-41655 on NVD →