Wordpress Countdown Widget Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affects WordPress Countdown Widget: from n/a through 3.1.9.1.

Affected:

up to 3.1.9.3

Fixed in:

3.1.9.3

Disclosed:

Mar 27, 2024

CVE-2022-45847 on NVD →

The WordPress Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above...

CVSS:

5.5

Affected:

up to 3.1.9.2

Fixed in:

3.1.9.3

Disclosed:

Sep 19, 2022

CVE-2022-2944 on NVD →

The WordPress Countdown Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.9.1. This is due to missing or incorrect nonce validation on the admin_header function. This makes it possible for unauthenticated attackers to change plugin settings, via forged request...

CVSS:

8.8

Affected:

up to 3.1.9.1

Fixed in:

3.1.9.2

Disclosed:

Sep 6, 2022

CVE-2022-45847 on NVD →

The WordPress Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters when saving overall plugin language settings in versions up to, and including, 3.1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, w...

CVSS:

5.5

Affected:

up to 3.1.9.1

Fixed in:

3.1.9.2

Disclosed:

Sep 6, 2022

The WordPress Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters when saving overall plugin language settings in versions up to, and including, 3.1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, w...

Affected:

up to 3.1.9.2

Fixed in:

3.1.9.2

Disclosed:

Sep 6, 2022

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 3.1.9.3

Fixed in:

3.1.9.3

CVE-2022-2944 on NVD →