Spice Starter Sites Vulnerabilities

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content.

CVSS:

5.3

Affected:

up to 1.2.5

Fix:

No patched version reported

Disclosed:

Sep 30, 2024

CVE-2024-8430 on NVD →

The Spice Starter Sites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succ...

CVSS:

6.1

Affected:

up to 1.2.5

Fix:

No patched version reported

Disclosed:

Sep 16, 2024

CVE-2024-44003 on NVD →

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

1.0 – 1.0

Fixed in:

1.1

Disclosed:

Jul 18, 2023

CVE-2023-33999 on NVD →