Meks Smart Author Widget Vulnerabilities

The Meks Smart Author Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts...

CVSS:

6.4

Affected:

up to 1.1.4

Fixed in:

1.1.5

Disclosed:

Jul 10, 2024

CVE-2024-37958 on NVD →

The Meks Smart Social Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the meks_remove_notification function. This makes it possible for unauthenticated attackers to dismiss admin notices via a forged r...

CVSS:

4.3

Affected:

up to 1.1.3

Fixed in:

1.1.4

Disclosed:

Jul 26, 2023

CVE-2023-25989 on NVD →