Easy Pricing Tables Vulnerabilities

The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Cont...

CVSS:

6.4

Affected:

up to 3.2.6

Fixed in:

3.2.7

Disclosed:

Nov 5, 2024

CVE-2024-8323 on NVD →

The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.5. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVSS:

6.1

Affected:

up to 3.2.5

Fixed in:

3.2.6

Disclosed:

Oct 29, 2024

CVE-2024-8871 on NVD →

The Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level...

CVSS:

6.4

Affected:

up to 3.2.2

Fixed in:

3.2.3

Disclosed:

Jan 4, 2023

CVE-2022-4654 on NVD →

The Easy Pricing Tables plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the multiple parameters in versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping in the ptp_design4_color_columns() function. This makes it possible for unauthenticated attackers to...

CVSS:

6.1

Affected:

up to 3.2.0

Fixed in:

3.2.1

Disclosed:

Jun 3, 2022

CVE-2022-1904 on NVD →

Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress.

CVSS:

4.8

Affected:

up to 3.1.2

Fixed in:

3.1.3

Disclosed:

May 27, 2022

CVE-2021-36866 on NVD →

The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in the trash

CVSS:

6.5

Affected:

up to 3.1.2

Fixed in:

3.1.3

Disclosed:

Feb 1, 2022

CVE-2021-25098 on NVD →