wpb_show_core 漏洞

严重CVE-2023-59742023/11/06

WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery

The WPB Show Core WordPress plugin through version 2.2 is vulnerable to Server-Side Request Forgery (SSRF) via the 'path' parameter in the download-file.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs.

wpb_show_corePoC 已收录

CVSS9.8EPSS 80.8%

中危CVE-2022-34842022/11/14

WordPress WPB Show Core - Cross-Site Scripting

WordPress wpb-show-core plugin through TODO contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

wpb_show_corePoC 已收录

CVSS6.1EPSS 7.8%

wpb_show_core

关联漏洞

WordPress WPB Show Core <= 2.2 - Server-Side Request Forgery

WordPress WPB Show Core - Cross-Site Scripting