Meks Themeforest Smart Widget Vulnerabilities

The Meks ThemeForest Smart Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above,...

CVSS:

4.4

Affected:

up to 1.5

Fixed in:

1.6

Disclosed:

Apr 26, 2024

CVE-2024-33694 on NVD →

The Meks Smart Social Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the meks_remove_notification function. This makes it possible for unauthenticated attackers to dismiss admin notices via a forged r...

CVSS:

4.3

Affected:

up to 1.4

Fixed in:

1.5

Disclosed:

Jul 26, 2023

CVE-2023-25989 on NVD →