Bnfw Vulnerabilities

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 1.6.14

Fixed in:

1.7

Disclosed:

Jul 18, 2023

CVE-2023-33999 on NVD →

The Better Notifications for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the handle_actions function. This makes it possible for unauthenticated attackers to enable or disable notifications via a for...

CVSS:

4.3

Affected:

up to 1.9.2

Fixed in:

1.9.3

Disclosed:

May 18, 2023

CVE-2023-32964 on NVD →

The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).

CVSS:

4.3

Affected:

up to 1.8.7

Fixed in:

1.8.7

Disclosed:

Jan 31, 2022

CVE-2022-0345 on NVD →