Protected Posts Logout Button Vulnerabilities

The Protected Posts Logout Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages tha...

CVSS:

4.4

Affected:

up to 1.4.5

Fixed in:

1.4.6

Disclosed:

Feb 20, 2023

CVE-2023-25978 on NVD →

The Protected Posts Logout Button plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pplb_options_save function in versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to update the plugin's settings. A nonce check was added...

CVSS:

6.5

Affected:

up to 1.4.5

Fixed in:

1.4.6

Disclosed:

Feb 16, 2023

CVE-2023-25454 on NVD →

The Protected Posts Logout Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on the pplb_options_save function. This makes it possible for unauthenticated attackers to update plugin settings via a forged...

CVSS:

5.4

Affected:

up to 1.4.4

Fixed in:

1.4.5

Disclosed:

Feb 16, 2023