Uncanny Toolkit Pro Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Cross Site Request Forgery.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.

Affected:

up to 4.1.4.1

Fixed in:

4.1.4.1

Disclosed:

Jan 2, 2025

CVE-2024-37438 on NVD →

[en] Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through 4.1.4.0

Affected:

up to 4.1.4.1

Fixed in:

4.1.4.1

Disclosed:

Nov 1, 2024

CVE-2024-37439 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Reflected XSS.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.

Affected:

up to 4.1.4.1

Fixed in:

4.1.4.1

Disclosed:

Jul 22, 2024

CVE-2024-37436 on NVD →

The Uncanny Toolkit Pro for LearnDash plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if the...

CVSS:

6.1

Affected:

up to 4.1.4

Fixed in:

4.1.4.1

Disclosed:

Jun 28, 2024

CVE-2024-37436 on NVD →

The Uncanny Toolkit Pro for LearnDash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on a function in all versions up to, and including, 4.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to duplicate posts and pa...

CVSS:

4.3

Affected:

up to 4.1.4

Fixed in:

4.1.4.1

Disclosed:

Jun 28, 2024

CVE-2024-37439 on NVD →

The Uncanny Toolkit Pro for LearnDash plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request...

CVSS:

4.3

Affected:

up to 4.1.4

Fixed in:

4.1.4.1

Disclosed:

Jun 28, 2024

CVE-2024-37438 on NVD →