Simple Staff List Vulnerabilities

The Simple Staff List plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the ajax_flush_rewrite_rules and staff_member_export functions in versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscribe...

CVSS:

5.4

Affected:

up to 2.2.4

Fixed in:

2.2.5

Disclosed:

Dec 27, 2023

CVE-2023-51526 on NVD →

The Simple Staff List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post editor settings in versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary...

CVSS:

4.4

Affected:

up to 2.2.3

Fixed in:

2.2.4

Disclosed:

Aug 17, 2023

CVE-2023-28790 on NVD →

The Simple Staff List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level...

CVSS:

6.4

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

Jan 20, 2023

CVE-2023-23686 on NVD →