Tiempocom Vulnerabilities

The Tiempo.com plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if t...

CVSS:

6.1

Affected:

up to 0.1.2

Fix:

No patched version reported

Disclosed:

Apr 25, 2023

CVE-2023-2272 on NVD →

The Tiempo.com plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.1.2. This is due to missing or incorrect nonce validation on the process_bulk_action() function used to manage shortcodes. This makes it possible for unauthenticated attackers to delete shortcodes via a f...

CVSS:

5.4

Affected:

up to 0.1.2

Fix:

No patched version reported

Disclosed:

Apr 25, 2023

CVE-2023-2271 on NVD →

The Tiempo.com plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.1.2. This is due to missing or incorrect nonce validation on the tc_print_shortcode_form() function used to create shortcodes. This makes it possible for unauthenticated attackers to modify shortcodes and...

CVSS:

5.4

Affected:

up to 0.1.2

Fix:

No patched version reported

Disclosed:

Apr 25, 2023

CVE-2023-0058 on NVD →