Coming Soon By Supsystic Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Coming Soon by Supsystic plugin <= 1.7.10 versions.

Affected:

up to 1.7.11

Fixed in:

1.7.11

Disclosed:

May 22, 2023

CVE-2023-22714 on NVD →

The Coming Soon by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.10. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke that function, via forged request granted t...

CVSS:

8.8

Affected:

up to 1.7.10

Fixed in:

1.7.11

Disclosed:

Jan 19, 2023

CVE-2023-22714 on NVD →

[en] The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting

Affected:

up to 1.7.6

Fixed in:

1.7.6

Disclosed:

Apr 25, 2022

CVE-2021-46781 on NVD →

The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS:

6.1

Affected:

up to 1.7.5

Fixed in:

1.7.6

Disclosed:

Apr 9, 2022

CVE-2021-46781 on NVD →