Wp Inject Vulnerabilities

[en] The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected:

up to 1.18

Fix:

No patched version reported

Disclosed:

Dec 26, 2022

CVE-2022-4243 on NVD →

The ImageInject plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject a...

CVSS:

5.5

Affected:

up to 1.18

Fix:

No patched version reported

Disclosed:

Dec 2, 2022

CVE-2022-4243 on NVD →

[en] The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.

Affected:

up to 1.16

Fixed in:

1.16

Disclosed:

Jan 8, 2018

CVE-2018-5285 on NVD →

[en] The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.

Affected:

up to 1.16

Fixed in:

1.16

Disclosed:

Jan 8, 2018

CVE-2018-5284 on NVD →

The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.

CVSS:

8.8

Affected:

up to 1.15

Fixed in:

1.16

Disclosed:

Jan 4, 2018

CVE-2018-5285 on NVD →

The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.

CVSS:

6.1

Affected:

up to 1.15

Fixed in:

1.16

Disclosed:

Jan 4, 2018

CVE-2018-5284 on NVD →