Attorney Vulnerabilities

[en] Missing Authorization vulnerability in Hennessey Digital Attorney.This issue affects Attorney: from n/a through 3.

Affected:

up to 3

Fix:

No patched version reported

Disclosed:

Jun 19, 2024

CVE-2022-45832 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Hennessey Digital Attorney theme <= 3 theme.

Affected:

up to 3

Fix:

No patched version reported

Disclosed:

Oct 2, 2023

CVE-2023-41692 on NVD →

The Attorney theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a use...

CVSS:

6.1

Affected:

up to 3

Fix:

No patched version reported

Disclosed:

Sep 4, 2023

CVE-2023-41692 on NVD →

The Attorney theme for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the hd_delete_index_page function hooked via admin_init in versions up to, and including, 3. This makes it possible for unauthenticated attackers to delete arbitrary posts and content via the 'drop' paramete...

CVSS:

6.5

Affected:

up to 3

Fix:

No patched version reported

Disclosed:

Dec 1, 2022

CVE-2022-45832 on NVD →

No patched version is available. Dave Jong discovered and reported this Broken Access Control vulnerability in WordPress Attorney Theme. This vulnerability has not been known to be fixed yet.

Affected:

up to 3

Fix:

No patched version reported

The plugin does not have authorisation and CSRF when deleting post/page, which could allow unauthenticated attackers to delete arbitrary posts or pages

Affected:

up to 3

Fix:

No patched version reported