Meks Easy Ads Widget Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8.

Affected:

up to 2.0.9

Fixed in:

2.0.9

Disclosed:

Jul 21, 2024

CVE-2024-37548 on NVD →

The Meks Easy Ads Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in...

CVSS:

4.4

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Jul 6, 2024

CVE-2024-37548 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the...

Affected:

up to 2.0.8

Fixed in:

2.0.8

Disclosed:

Oct 3, 2023

CVE-2023-25989 on NVD →

The Meks Smart Social Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the meks_remove_notification function. This makes it possible for unauthenticated attackers to dismiss admin notices via a forged r...

CVSS:

4.3

Affected:

up to 2.0.7

Fixed in:

2.0.8

Disclosed:

Jul 26, 2023

CVE-2023-25989 on NVD →