Wp Gotowebinar Vulnerabilities

[en] Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6.

Affected:

up to 15.7

Fixed in:

15.7

Disclosed:

Nov 1, 2024

CVE-2024-38695 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson WP GoToWebinar allows Cross-Site Scripting (XSS).This issue affects WP GoToWebinar: from n/a through 15.7.

Affected:

up to 15.8

Fixed in:

15.8

Disclosed:

Aug 2, 2024

CVE-2024-38776 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Martin Gibson WP GoToWebinar allows Stored XSS.This issue affects WP GoToWebinar: from n/a through 15.7.

Affected:

up to 15.8

Fixed in:

15.8

Disclosed:

Jul 20, 2024

CVE-2024-38671 on NVD →

The WP GoToWebinar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 15.7. This is due to missing or incorrect nonce validation on the wp_gotowebinar_save_authentication_details() function. This makes it possible for unauthenticated attackers to inject malicious web...

CVSS:

6.1

Affected:

up to 15.7

Fixed in:

15.8

Disclosed:

Jul 19, 2024

CVE-2024-38776 on NVD →

The WP GoToWebinar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wp_gotowebinar_get_access_and_refresh_token_call() function in versions up to, and including, 15.6. This makes it possible for authenticated attackers, with subscriber-level access and abo...

CVSS:

4.3

Affected:

up to 15.6

Fixed in:

15.7

Disclosed:

Jul 11, 2024

CVE-2024-38695 on NVD →

The WP GoToWebinar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

6.4

Affected:

up to 15.7

Fixed in:

15.8

Disclosed:

Jul 10, 2024

CVE-2024-38671 on NVD →

[en] Missing Authorization vulnerability in Martin Gibson WP GoToWebinar.This issue affects WP GoToWebinar: from n/a through 14.46.

Affected:

up to 15.1

Fixed in:

15.1

Disclosed:

Jun 9, 2024

CVE-2024-32804 on NVD →

The WP GoToWebinar plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wp_gotowebinar_delete_log_callback() function in versions up to, and including, 14.46. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete logs.

CVSS:

4.3

Affected:

up to 14.46

Fixed in:

15.1

Disclosed:

Apr 22, 2024

CVE-2024-32804 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson WP GoToWebinar plugin <= 14.45 versions.

Affected:

up to 14.46

Fixed in:

14.46

Disclosed:

Oct 24, 2023

CVE-2023-45832 on NVD →

The WP GoToWebinar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in versions up to, and including, 14.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scr...

CVSS:

4.4

Affected:

up to 14.45

Fixed in:

14.46

Disclosed:

Oct 13, 2023

CVE-2023-45832 on NVD →

The WP GoToWebinar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 14.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitr...

Affected:

up to 14.46

Fixed in:

14.46