Vc Tabs Vulnerabilities

The Tabs – Responsive Tabs with WooCommerce Product Tab Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administ...

CVSS:

4.4

Affected:

up to 4.0.6

Fix:

No patched version reported

Disclosed:

Jun 20, 2024

CVE-2024-37120 on NVD →

The Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with high-level permissions, to inject arbitrary web scripts in pages...

CVSS:

7.2

Affected:

up to 3.7.1

Fixed in:

3.7.2

Disclosed:

Sep 22, 2022

CVE-2022-40215 on NVD →

The Tabs – Responsive Tabs with WooCommerce Product Tab Extension plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.6.8. This is due to a lack of validation on the settings supplied to the post_oxi_settings() function. This makes it possible for authenticated attackers,...

CVSS:

7.2

Affected:

up to 3.6.0

Fixed in:

3.7.0

Disclosed:

Jul 26, 2022

CVE-2022-36375 on NVD →

The Responsive Tabs with WooCommerce Product Tab Extension plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 3.5.4. As a result, unauthenticated users could update arbitrary options.

CVSS:

9.8

Affected:

up to 3.6.0

Fixed in:

3.6.0

Disclosed:

Dec 20, 2021