Owm Weather Vulnerabilities

The OWM Weather plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.6.11. This is due to missing or incorrect nonce validation on the owmw_duplicate_post_as_draft function. This makes it possible for unauthenticated attackers to duplicate posts, via forged request grante...

CVSS:

8.8

Affected:

up to 5.6.11

Fixed in:

5.6.12

Disclosed:

Dec 12, 2022

CVE-2022-47179 on NVD →

The OWM Weather plugin for WordPress is vulnerable to unspecified SQL Injection via the ‘post’ parameter in versions up to, and including, 5.6.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for Contributor-level attacke...

CVSS:

8.8

Affected:

up to 5.6.8

Fixed in:

5.6.9

Disclosed:

Nov 2, 2022

CVE-2022-3769 on NVD →