Htaccess Vulnerabilities

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attack...

CVSS:

8.8

Affected:

up to 1.8.1

Fixed in:

1.8.2

Disclosed:

Feb 1, 2020

CVE-2020-8658 on NVD →

The "Htaccess by BestWebSoft – WordPress Website Access Control Plugin" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping on the 'category' parameter. This makes it possible for unauthenticated attacker...

CVSS:

6.1

Affected:

up to 1.7.6

Fixed in:

1.7.6

Disclosed:

Apr 14, 2017

CVE-2017-18496 on NVD →