Wp Imagezoom Vulnerabilities

The Wp-ImageZoom plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

CVSS:

6.1

Affected:

up to 1.1.0

Fix:

No patched version reported

Disclosed:

Oct 16, 2024

CVE-2024-9934 on NVD →

The Wp-ImageZoom plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in the 'zoom.php' file in versions up to, and including, 1.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthe...

CVSS:

9.8

Affected:

up to 1.0.7

Fixed in:

1.1.0

Disclosed:

Oct 9, 2013

The Wp-ImageZoom plugin for WordPress is vulnerable to Directory Traversal in versions before 1.0.5 via the 'file' parameter. This allows attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS:

5.3

Affected:

up to 1.0.5

Fixed in:

1.0.5

Disclosed:

Jun 18, 2012