Button Contact Vr Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VirusTran Button contact VR allows Stored XSS.This issue affects Button contact VR: from n/a through 4.7.9.1.

Affected:

up to 4.7.10

Fixed in:

4.7.10

Disclosed:

Oct 29, 2024

CVE-2024-50414 on NVD →

The Button contact VR plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in...

CVSS:

5.5

Affected:

up to 4.7.9.1

Fixed in:

4.7.10

Disclosed:

Oct 24, 2024

CVE-2024-50414 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in VirusTran Button contact VR allows Stored XSS.This issue affects Button contact VR: from n/a through 4.7.3.

Affected:

up to 4.7.8

Fixed in:

4.7.8

Disclosed:

Aug 18, 2024

CVE-2024-43347 on NVD →

The Button contact VR plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pa...

CVSS:

4.4

Affected:

up to 4.7.7

Fixed in:

4.7.8

Disclosed:

Aug 16, 2024

CVE-2024-43347 on NVD →

[en] The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 4.7.2

Fixed in:

4.7.2

Disclosed:

May 23, 2024

CVE-2024-2220 on NVD →

The Button contact VR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject a...

CVSS:

4.4

Affected:

up to 4.7

Fixed in:

4.7.2

Disclosed:

May 2, 2024

CVE-2024-2220 on NVD →