Streamcast Vulnerabilities

The StreamCast – Radio Player for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above,...

CVSS:

4.4

Affected:

up to 2.2.3

Fixed in:

2.2.4

Disclosed:

Aug 7, 2024

CVE-2024-43148 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 2.1.4

Fixed in:

2.1.4

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →

The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode

CVSS:

5.4

Affected:

up to 2.1.1

Fixed in:

2.1.1

Disclosed:

Sep 20, 2021

CVE-2021-24416 on NVD →