Search

Find a vulnerability

Search criteria

    3 vulnerabilities by wbolt

    CVE-2024-12591 (GCVE-0-2024-12591)

    Vulnerability from cvelistv5 – Published: 2024-12-21 09:23 – Updated: 2026-04-08 17:33
    VLAI
    Title
    MagicPost <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode
    Summary
    The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wb_share_social shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-12-23 16:40 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Wordfence CNA
    References
    Impacted products
    Credits
    SOPROBRO
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12591",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-23T16:40:50.634185Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-28T00:48:46.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MagicPost \u2013 WordPress\u6587\u7ae0\u7ba1\u7406\u529f\u80fd\u589e\u5f3a\u63d2\u4ef6",
          "vendor": "wbolt",
          "versions": [
            {
              "lessThanOrEqual": "1.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SOPROBRO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s wb_share_social shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:33:53.042Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f81355fa-5b12-4b03-bd3d-f9e2cb734390?source=cve"
        },
        {
          "url": "https://wordpress.org/plugins/magicpost/#developers"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3209000%40magicpost\u0026new=3209000%40magicpost\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-12-20T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MagicPost \u003c= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-12591",
    "datePublished": "2024-12-21T09:23:56.620Z",
    "dateReserved": "2024-12-12T21:34:41.606Z",
    "dateUpdated": "2026-04-08T17:33:53.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-6319 (GCVE-0-2024-6319)

    Vulnerability from cvelistv5 – Published: 2024-07-04 08:32 – Updated: 2026-04-08 16:57
    VLAI
    Title
    IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'
    Summary
    The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-07-05 13:57 UTC
    CWE
    • CWE-434 - Unrestricted Upload of File with Dangerous Type
    Assigner
    Wordfence CNA
    References
    Impacted products
    Vendor Product Version
    wbolt IMGspider – 图片采集抓取插件 Affected: 0 , ≤ 2.3.10 (semver)
    		Create a notification for this product.
    wbolt imgspider Affected: 0 , ≤ 2.3.10 (custom)
        cpe:2.3:a:wbolt:imgspider:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    István Márton
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wbolt:imgspider:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "imgspider",
            "vendor": "wbolt",
            "versions": [
              {
                "lessThanOrEqual": "2.3.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6319",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-05T13:57:39.429099Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-08T17:42:05.863Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:33:05.386Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/63a4a077-c99e-4742-9fa1-f323fd24b950?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.class.php#L189"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3107741/imgspider"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "IMGspider \u2013 \u56fe\u7247\u91c7\u96c6\u6293\u53d6\u63d2\u4ef6",
          "vendor": "wbolt",
          "versions": [
            {
              "lessThanOrEqual": "2.3.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Istv\u00e1n M\u00e1rton"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the \u0027upload\u0027 function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:57:24.127Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/63a4a077-c99e-4742-9fa1-f323fd24b950?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.class.php#L189"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3107741/imgspider"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-06-25T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2024-06-25T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2024-07-03T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "IMGspider \u003c= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via \u0027upload\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-6319",
    "datePublished": "2024-07-04T08:32:21.972Z",
    "dateReserved": "2024-06-25T12:50:14.695Z",
    "dateUpdated": "2026-04-08T16:57:24.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-6318 (GCVE-0-2024-6318)

    Vulnerability from cvelistv5 – Published: 2024-07-04 08:32 – Updated: 2026-04-08 16:44
    VLAI
    Title
    IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'
    Summary
    The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-07-05 18:00 UTC
    CWE
    • CWE-434 - Unrestricted Upload of File with Dangerous Type
    Assigner
    Wordfence CNA
    References
    Impacted products
    Vendor Product Version
    wbolt IMGspider – 图片采集抓取插件 Affected: 0 , ≤ 2.3.10 (semver)
    		Create a notification for this product.
    wbolt imgspider Affected: 0 , ≤ 2.3.10 (custom)
        cpe:2.3:a:wbolt:imgspider:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    István Márton
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wbolt:imgspider:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "imgspider",
            "vendor": "wbolt",
            "versions": [
              {
                "lessThanOrEqual": "2.3.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6318",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-05T18:00:35.150379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-08T16:54:12.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:33:05.664Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/306f00e4-9a70-48be-a91e-e396643a8129?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.class.php#L122"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3107741/imgspider"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "IMGspider \u2013 \u56fe\u7247\u91c7\u96c6\u6293\u53d6\u63d2\u4ef6",
          "vendor": "wbolt",
          "versions": [
            {
              "lessThanOrEqual": "2.3.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Istv\u00e1n M\u00e1rton"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the \u0027upload_img_file\u0027 function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:44:49.354Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/306f00e4-9a70-48be-a91e-e396643a8129?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.class.php#L122"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3107741/imgspider"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-06-25T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2024-06-25T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2024-07-03T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "IMGspider \u003c= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via \u0027upload_img_file\u0027"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-6318",
    "datePublished": "2024-07-04T08:32:20.895Z",
    "dateReserved": "2024-06-25T12:50:08.097Z",
    "dateUpdated": "2026-04-08T16:44:49.354Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}