Gtmetrix For Wordpress Vulnerabilities

The GTmetrix for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.7. This is due to missing nonce validation on the tests_page() function. This makes it possible for unauthenticated attackers to invoke this function and delete arbitrary posts via a forged...

CVSS:

4.3

Affected:

up to 0.4.7

Fixed in:

0.4.8

Disclosed:

Jul 19, 2023

CVE-2023-37996 on NVD →

The GTmetrix for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'report_id' and 'event_id' parameters in versions up to, and including, 0.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web s...

CVSS:

6.1

Affected:

up to 0.4.6

Fixed in:

0.4.7

Disclosed:

May 9, 2023

CVE-2023-32503 on NVD →

The GTmetrix for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in versions up to, and including, 0.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that e...

CVSS:

6.1

Affected:

up to 0.4.5

Fixed in:

0.4.6

Disclosed:

Mar 2, 2023

CVE-2023-23677 on NVD →