Newsmag Vulnerabilities

The Newsmag theme for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenev...

CVSS:

5.4

Affected:

up to 2.4.4

Fix:

No patched version reported

Disclosed:

Mar 16, 2023

CVE-2023-28493 on NVD →

The tagDiv Composer plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, but not including, 3.5 due to improper implementation of the Facebook login feature. This allows unauthenticated attackers to log in as any user as long as they know the user's email addres...

CVSS:

9.8

Affected:

up to 5.2.1

Fixed in:

5.2.2

Disclosed:

Oct 24, 2022

CVE-2022-3477 on NVD →

The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.

CVSS:

6.1

Affected:

up to 5.0

Fixed in:

5.0

Disclosed:

Jul 12, 2021

CVE-2021-24304 on NVD →

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <=...

CVSS:

9.8

Affected:

up to 2.4.1

Fixed in:

2.4.2

Disclosed:

Oct 1, 2020

CVE-2020-36708 on NVD →