Category Specific Rss Feed Menu Vulnerabilities

The Category Specific RSS feed Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and...

CVSS:

4.4

Affected:

up to 2.2

Fixed in:

2.3

Disclosed:

Apr 19, 2023

CVE-2023-22685 on NVD →

The Category Specific RSS feed Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the category_specific_option_page function used to control plugin settings. This makes it possible for unauthenticated attackers...

CVSS:

4.3

Affected:

up to 2.2

Fixed in:

2.2

Disclosed:

Jan 20, 2023

CVE-2023-22691 on NVD →

Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVSS:

8.8

Affected:

up to 2.0

Fixed in:

2.1

Disclosed:

Jul 18, 2019

CVE-2019-5993 on NVD →