Show filters
14 Total Results
Displaying 11-14 of 14
Sort by:
Attacker Value
Unknown
CVE-2022-2376
Disclosure Date: September 05, 2022 (last updated October 08, 2023)
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
0
Attacker Value
Unknown
CVE-2022-2377
Disclosure Date: August 22, 2022 (last updated October 08, 2023)
The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog
0
Attacker Value
Unknown
CVE-2022-2046
Disclosure Date: August 08, 2022 (last updated October 08, 2023)
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.
0
Attacker Value
Unknown
CVE-2021-24981
Disclosure Date: December 21, 2021 (last updated October 07, 2023)
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
0
