Ultimate Noindex Nofollow Tool Ii Vulnerabilities

The Ultimate Noindex Nofollow Tool II plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVSS:

4.4

Affected:

up to 1.3.5

Fixed in:

1.3.6

Disclosed:

Mar 25, 2024

CVE-2024-1663 on NVD →

The Ultimate Noindex Nofollow Tool II plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the unn_admin function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forge...

CVSS:

4.3

Affected:

up to 1.3.4

Fixed in:

1.3.4

Disclosed:

Apr 13, 2023

CVE-2023-30474 on NVD →