Intelly Welcome Bar Vulnerabilities

The Welcome Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages th...

CVSS:

4.4

Affected:

up to 2.1.0

Fixed in:

2.2.0

Disclosed:

Apr 4, 2025

CVE-2025-32129 on NVD →

The Welcome Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.3. This is due to missing or incorrect nonce validation on the iwb_do_action function. This makes it possible for unauthenticated attackers to invoke this AJAX action via a forged request granted they...

CVSS:

4.3

Affected:

up to 2.0.3

Fixed in:

2.0.4

Disclosed:

Mar 31, 2023

The Welcome Bar for WordPress is vulnerable to unauthorized AJAX action access due to a missing capability check on the iwb_do_action function in versions up to, and including, 2.0.3. This makes it possible for subscriber-level attackers invoke this action.

CVSS:

4.3

Affected:

up to 2.0.3

Fixed in:

2.0.4

Disclosed:

Mar 31, 2023