Wp Browser Update Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.4.1 versions.

Affected:

up to 4.5

Fixed in:

4.5

Disclosed:

Nov 10, 2023

CVE-2023-31078 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.5 versions.

Affected:

up to 4.6

Fixed in:

4.6

Disclosed:

Aug 17, 2023

CVE-2023-28690 on NVD →

The WP BrowserUpdate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple parameters in versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. Combined with a Cross-Site Request Forgery vulnerability in versions <= 4.4.1, this makes it possible for u...

CVSS:

4.8

Affected:

up to 4.5

Fixed in:

4.6

Disclosed:

Apr 26, 2023

CVE-2023-28690 on NVD →

The WP BrowserUpdate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.1. This is due to missing or incorrect nonce validation on the wpbu_administration function. This makes it possible for unauthenticated attackers to modify the plugin settings via a forged request...

CVSS:

4.3

Affected:

up to 4.4.1

Fixed in:

4.5

Disclosed:

Apr 24, 2023

CVE-2023-31078 on NVD →