Comment Reply Email Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting (XSS).This issue affects Comment Reply Email: from n/a through 1.3.

Affected:

up to 1.5

Fixed in:

1.5

Disclosed:

Jul 12, 2024

CVE-2024-35773 on NVD →

The Comment Reply Email plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the optionsPage() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject maliciou...

CVSS:

6.1

Affected:

up to 1.3

Fixed in:

1.5

Disclosed:

Jul 5, 2024

CVE-2024-35773 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions.

Affected:

up to 1.0.4

Fixed in:

1.0.4

Disclosed:

Oct 18, 2023

CVE-2023-45008 on NVD →

The Comment Reply Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting settings in versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web sc...

CVSS:

4.4

Affected:

up to 1.0.3

Fixed in:

1.0.4

Disclosed:

Oct 3, 2023

CVE-2023-45008 on NVD →