Erident Custom Login And Dashboard Vulnerabilities

The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)

CVSS:

4.8

Affected:

up to 3.5.8

Fixed in:

3.5.9

Disclosed:

Apr 1, 2021

CVE-2021-24658 on NVD →

The Erident Custom Login and Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting via the ‘er_options_up[dashboard_data_left]’ parameter in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for una...

CVSS:

8.8

Affected:

up to 3.4.1

Fixed in:

3.5

Disclosed:

Jun 18, 2015

CVE-2015-9322 on NVD →

The Erident Custom Login & Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.1. This is due to missing or incorrect nonce validation in the 'erident-custom-login-and-dashboard/trunk/er-custom-login.php' file. This makes it possible for unauthenticated attac...

CVSS:

8.8

Affected:

up to 3.4.1

Fixed in:

3.5

Disclosed:

Jun 10, 2015