PRODUCT PROFILE

tagdiv_composer

暂无产品描述。

tagdivwordpress

关联漏洞

共找到 2 条公开漏洞记录

中危CVE-2023-31692023/09/11

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

tagdiv_composerPoC 已收录

CVSS6.1

严重CVE-2022-34772022/11/14

WordPress tagDiv Composer < 3.5 - Authentication Bypass

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address

tagdiv_composerPoC 已收录

CVSS9.8