Catch Duplicate Switcher Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Catch Duplicate Switcher allows Reflected XSS. This issue affects Catch Duplicate Switcher: from n/a through 2.0.

Affected:

up to 2.0

Fix:

No patched version reported

Disclosed:

Mar 3, 2025

CVE-2025-23619 on NVD →

The Catch Duplicate Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can s...

CVSS:

6.1

Affected:

up to 2.1

Fixed in:

2.2

Disclosed:

Jan 16, 2025

CVE-2025-23619 on NVD →

[en] Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin be...

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Oct 18, 2021

CVE-2021-24752 on NVD →

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before...

CVSS:

5.4

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Sep 20, 2021

CVE-2021-24752 on NVD →