Buttonizer Multifunctional Button Vulnerabilities

[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....

Affected:

up to 2.6.3

Fixed in:

2.6.3

Disclosed:

Oct 16, 2024

CVE-2022-4974 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 2.6.3

Fixed in:

2.6.3

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

Affected:

up to 2.6.3

Fixed in:

2.6.3

Disclosed:

Mar 4, 2022

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Buttonizer plugin (versions < 2.6.3).

Affected:

up to 2.6.3

Fixed in:

2.6.3

Disclosed:

Feb 28, 2022

Sensitive Information Disclosure vulnerability discovered in WordPress Buttonizer plugin (versions < 2.6.3).

Affected:

up to 2.6.3

Fixed in:

2.6.3

Disclosed:

Feb 28, 2022

[en] The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Affected:

up to 2.6.3

Fixed in:

2.6.3

Disclosed:

Dec 27, 2021

CVE-2021-24992 on NVD →

The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS:

4.8

Affected:

up to 2.5.4

Fixed in:

2.5.5

Disclosed:

Nov 29, 2021

CVE-2021-24992 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 3.3.10

Fixed in:

3.3.10

CVE-2023-33999 on NVD →