plugin
12 known security issues reported for the I Recommend This WordPress plugin. Most recent disclosed Nov 12, 2023.
Running I Recommend This on your site? Check whether your installed version is affected.
Scan your site free[en] Cross-Site Request Forgery (CSRF) vulnerability in Harish Chouhan, Themeist I Recommend This allows Cross Site Request Forgery.This issue affects I Recommend This: from n/a through 3.9.0.
[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Harish Chouhan, Themeist I Recommend This plugin <= 3.8.3 versions.
[en] A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is a...
The I Recommend This plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbi...
The I Recommend This plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.0. This is due to missing nonce validation on the ajax_callback function. This makes it possible for unauthenticated attackers to modify the plugins settings granted they can trick a site administ...
[en] The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
The I Recommend This plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
The I Recommend This plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Authenticated SQL Injection vulnerability found by Paul Dannewitz in WordPress I Recommend This plugin version 3.7.7 and earlier versions. A user with the lowest privileges (for example subscriber) can execute SQLi through [dot_recommends] shortcode if the default value of check for IP addresses is activated. Patched v...
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
The I Recommend This plugin for WordPress is vulnerable to SQL Injection via the 'post_type' attribute called via the plugin's shortcode in versions up to, and including, 3.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...
Plugin description: "This plugin allows your visitors to simply like/recommend your posts instead of comment on it." Active installs (according to https://wordpress.org/plugins/i-recommend-this/): 40.000+ It's possible to inject SQL into the [dot_recommends] shortcode, if the check for IP addresses i...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free