Cardoza 3D Tag Cloud Vulnerabilities

The 3D Tag Cloud plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious JavaScript via a forged request granted they can trick a site admini...

CVSS:

5.4

Affected:

up to 3.8

Fix:

No patched version reported

Disclosed:

Feb 6, 2024

CVE-2022-41990 on NVD →

The 3D Tag Cloud plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.8. This is due to missing or incorrect nonce validation when submitting plugin settings changes. This makes it possible for unauthenticated attackers to manipulate plugin settings, via forged request gr...

CVSS:

8.8

Affected:

up to 3.8

Fixed in:

3.9

Disclosed:

Sep 22, 2022

CVE-2022-36417 on NVD →