plugin

Tinymce Colorpicker Vulnerabilities

2 known security issues reported for the Tinymce Colorpicker WordPress plugin. Most recent disclosed May 1, 2014.

2 medium

Running Tinymce Colorpicker on your site? Check whether your installed version is affected.

Scan your site free

TinyMCE Color Picker < 1.2 - Cross-Site Request Forgery

medium

Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change plugin settings via unknown vectors.

CVSS:
4.3
Affected:
up to 1.2
Fixed in:
1.2
Disclosed:
May 1, 2014

CVE-2014-3845 on NVD →

TinyMCE Color Picker <= 1.1 - Missing Authorization

medium

The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.

CVSS:
5.3
Affected:
up to 1.1
Fixed in:
1.2
Disclosed:
Apr 28, 2014

CVE-2014-3844 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database