Vertical Scroll Recent Post Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy Vertical scroll recent.This issue affects Vertical scroll recent post: from n/a through 14.0.

Affected:

up to 14.0

Fix:

No patched version reported

Disclosed:

Nov 18, 2023

CVE-2023-47671 on NVD →

The Vertical scroll recent post plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 14.0. This is due to missing or incorrect nonce validation on the 'vsrp_admin_options' function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a f...

CVSS:

4.3

Affected:

up to 14.0

Fix:

No patched version reported

Disclosed:

Nov 8, 2023

CVE-2023-47671 on NVD →

[en] Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Vertical scroll recent post plugin <= 14.0 versions.

Affected:

up to 14.0

Fix:

No patched version reported

Disclosed:

May 9, 2023

CVE-2023-23862 on NVD →

The Vertical scroll recent post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in versions up to, and including, 14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level access, and a...

CVSS:

6.4

Affected:

up to 14.0

Fix:

No patched version reported

Disclosed:

Mar 21, 2023

CVE-2023-23862 on NVD →

[en] The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

Affected:

up to 14.0

Fixed in:

14.0

Disclosed:

May 9, 2022

CVE-2022-1171 on NVD →

The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

CVSS:

6.4

Affected:

up to 14.0

Fixed in:

14.0

Disclosed:

Apr 26, 2022

CVE-2022-1171 on NVD →