Swift Framework <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
medium
The Swift Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 2.7.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contr...
- CVSS:
- 6.4
- Affected:
- up to 2.7.31
- Fix:
- No patched version reported
- Disclosed:
- May 3, 2024
CVE-2024-3916 on NVD →
Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update
medium
The Swift Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sf_edit_directory_item() function in all versions up to, and including, 2.7.31. This makes it possible for unauthenticated attackers to update arbitrary posts with arbitrary content. Unfo...
- CVSS:
- 5.3
- Affected:
- up to 2.7.31
- Fix:
- No patched version reported
- Disclosed:
- May 3, 2024
CVE-2024-3915 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database