WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode
medium
The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level...
- CVSS:
- 6.4
- Affected:
- up to 4.5.4
- Fixed in:
- 4.5.5
- Disclosed:
- Feb 20, 2025
CVE-2025-1489 on NVD →
WP-Appbox [wp-appbox] < 4.5.4
unknown
[en] The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exec...
- Affected:
- up to 4.5.4
- Fixed in:
- 4.5.4
- Disclosed:
- Dec 24, 2024
CVE-2024-12710 on NVD →
WP-Appbox <= 4.5.3 - Reflected Cross-Site Scripting
medium
The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...
- CVSS:
- 6.1
- Affected:
- up to 4.5.3
- Fixed in:
- 4.5.4
- Disclosed:
- Dec 23, 2024
CVE-2024-12710 on NVD →
WP-Appbox [wp-appbox] < 4.4.0
unknown
[en] Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.
- Affected:
- up to 4.4.0
- Fixed in:
- 4.4.0
- Disclosed:
- Apr 11, 2022
CVE-2021-36910 on NVD →
WP-Appbox <= 4.3.20 - Authenticated (Admin+) Stored Cross-Site Scripting
medium
Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.
- CVSS:
- 4.8
- Affected:
- up to 4.3.20
- Fixed in:
- 4.3.21
- Disclosed:
- Apr 5, 2022
CVE-2021-36910 on NVD →
WP-Appbox <= 4.3.17 - Local File Inclusion
high
The WP-Appbox plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.3.17 via the 'tab' parameter. This allows authenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access co...
- CVSS:
- 8.8
- Affected:
- up to 4.3.17
- Fixed in:
- 4.3.18
- Disclosed:
- Jan 17, 2022
WP-Appbox [wp-appbox] < 4.3.18
unknown
Authenticated Local File Inclusion (LFI) vulnerability discovered by WPScanTeam in WordPress WP-Appbox plugin (versions <= 4.3.17).
- Affected:
- up to 4.3.18
- Fixed in:
- 4.3.18
- Disclosed:
- Jan 17, 2022
WP-Appbox [wp-appbox] < 4.3.18
unknown
The WP-Appbox plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.3.17 via the 'tab' parameter. This allows authenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access co...
- Affected:
- up to 4.3.18
- Fixed in:
- 4.3.18
- Disclosed:
- Jan 17, 2022
WP-Appbox [wp-appbox] < 4.3.18
unknown
The plugin does not validate user input before using it to create a local path then passed to an include_once statement, leading to a Local File Inclusion issue
- Affected:
- up to 4.3.18
- Fixed in:
- 4.3.18
WP-Appbox [wp-appbox] < 4.5.5
unknown
- Affected:
- up to 4.5.5
- Fixed in:
- 4.5.5
CVE-2025-1489 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database