Tumult Hype Animations Vulnerabilities

The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary fil...

CVSS:

9.9

Affected:

up to 1.9.15

Fixed in:

1.9.16

Disclosed:

Nov 27, 2024

CVE-2024-11082 on NVD →

The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent function in all versions up to, and including, 1.9.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a...

CVSS:

4.3

Affected:

up to 1.9.14

Fixed in:

1.9.15

Disclosed:

Nov 5, 2024

CVE-2024-10543 on NVD →

The Tumult Hype Animations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.11. This is due to missing or incorrect nonce validation on the hypeanimations_updatecontainer() function. This makes it possible for unauthenticated attackers to inject malicious web sc...

CVSS:

6.1

Affected:

up to 1.9.11

Fixed in:

1.9.12

Disclosed:

Mar 28, 2024

CVE-2024-30461 on NVD →

The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the hypeanimations_panel_upload() functionin all versions up to, and including, 1.9.12. This makes it possible for authenticated attackers, with author-level access and above, to upload ar...

CVSS:

8.8

Affected:

up to 1.9.12

Fixed in:

1.9.13

Disclosed:

Mar 26, 2024

CVE-2024-2890 on NVD →