Infographic And List Builder Ilist Vulnerabilities

[en] The The AI Infographic Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.9.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticat...

Affected:

up to 5.0.0

Fixed in:

5.0.0

Disclosed:

Jan 31, 2025

CVE-2024-12415 on NVD →

The The AI Infographic Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.9.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated at...

CVSS:

6.5

Affected:

up to 4.9.0

Fixed in:

5.0.0

Disclosed:

Jan 30, 2025

CVE-2024-12415 on NVD →

[en] The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_generate_desc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level access and abo...

Affected:

up to 4.7.5

Fixed in:

4.7.5

Disclosed:

Jun 15, 2024

CVE-2024-5858 on NVD →

The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_generate_desc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVSS:

4.3

Affected:

up to 4.7.4

Fixed in:

4.7.5

Disclosed:

Jun 14, 2024

CVE-2024-5858 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Infographic Maker – iList allows Stored XSS.This issue affects Infographic Maker – iList: from n/a through 4.6.6.

Affected:

up to 4.6.8

Fixed in:

4.6.8

Disclosed:

Apr 22, 2024

CVE-2024-32696 on NVD →

The AI Infographic Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to i...

CVSS:

5.4

Affected:

up to 4.6.7

Fixed in:

4.6.8

Disclosed:

Apr 19, 2024

CVE-2024-32696 on NVD →

[en] The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection

Affected:

up to 4.3.8

Fixed in:

4.3.8

Disclosed:

Mar 21, 2022

CVE-2022-0747 on NVD →

The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection

CVSS:

9.8

Affected:

up to 4.3.7

Fixed in:

4.3.8

Disclosed:

Feb 28, 2022

CVE-2022-0747 on NVD →