Shiftcontroller Vulnerabilities

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL keys in all versions up to, and including, 4.9.66 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

6.1

Affected:

up to 4.9.66

Fixed in:

4.9.67

Disclosed:

Oct 3, 2024

CVE-2024-9435 on NVD →

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.9.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject ar...

CVSS:

4.4

Affected:

up to 4.9.64

Fixed in:

4.9.65

Disclosed:

Sep 23, 2024

CVE-2024-44040 on NVD →

The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie in versions up to, and including, 4.9.57. This makes it possible for an authenticated attacker with contributor access-level or above to inject a PHP Object. No...

CVSS:

7.5

Affected:

up to 4.9.57

Fixed in:

4.9.58

Disclosed:

May 16, 2024

CVE-2024-4733 on NVD →

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in versions up to, and including, 4.9.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVSS:

6.1

Affected:

up to 4.9.25

Fixed in:

4.9.26

Disclosed:

Apr 13, 2023

CVE-2023-1978 on NVD →

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hc_title’ parameter in versions up to, and including, 4.9.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web s...

CVSS:

7.2

Affected:

up to 4.9.23

Fixed in:

4.9.24

Disclosed:

Apr 6, 2023

CVE-2023-29424 on NVD →

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.23. This is due to missing or incorrect nonce validation on the get method of the HC3_Post class. This makes it possible for unauthenticated attackers to perform unauthori...

CVSS:

5.4

Affected:

up to 4.9.23

Fixed in:

4.9.24

Disclosed:

Apr 6, 2023

CVE-2023-29425 on NVD →