Meks Smart Social Widget Vulnerabilities

The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

CVSS:

4.4

Affected:

up to 1.6.4

Fixed in:

1.6.5

Disclosed:

Apr 26, 2024

CVE-2024-33693 on NVD →

The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meks Smart Social Widget in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to...

CVSS:

4.4

Affected:

up to 1.6.3

Fixed in:

1.6.4

Disclosed:

Jan 26, 2024

CVE-2024-0664 on NVD →

The Meks Smart Social Widget plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the meks_remove_notification function in versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to dismiss admin notices.

CVSS:

5.3

Affected:

up to 1.6

Fixed in:

1.6.1

Disclosed:

Jul 27, 2023

The Meks Smart Social Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the meks_remove_notification function. This makes it possible for unauthenticated attackers to dismiss admin notices via a forged r...

CVSS:

4.3

Affected:

up to 1.6

Fixed in:

1.6.1

Disclosed:

Jul 26, 2023

CVE-2023-25989 on NVD →