Ays-Pro
Page 2 of 2 — Ays-Pro CVEs from a corpus of 141, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27996 | Medium | 5.9 | 2024-03-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS.This iss… |
CVE-2023-6591 | Medium | 4.8 | 2024-02-12 | The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-47526 | Medium | 5.9 | 2024-02-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allo… |
CVE-2024-1079 | Medium | 5.3 | 2024-02-07 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() function in all ve… |
CVE-2024-1078 | Medium | 4.3 | 2024-02-07 | The Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ays_quick_start() and add_quest… |
CVE-2024-22027 | Medium | 6.5 | 2024-01-12 | Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (… |
CVE-2023-6166 | Medium | 6.1 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting |
CVE-2023-6155 | Medium | 5.3 | 2023-12-26 | The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacke… |
CVE-2023-5874 | Medium | 4.8 | 2023-12-04 | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-5809 | Medium | 4.8 | 2023-12-04 | The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-5343 | Medium | 4.8 | 2023-11-20 | The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-34013 | Medium | 4.4 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in Poll Maker Team Poll Maker – Best WordPress Poll Plugin.This issue affects Poll Maker – Best WordPress Poll… |
CVE-2023-4390 | Medium | 4.8 | 2023-10-31 | The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to… |
CVE-2023-39917 | Medium | 4.3 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions. |
CVE-2023-41871 | High | 7.1 | 2023-09-25 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Poll Maker Team Poll Maker plugin <= 4.7.0 versions. |
CVE-2023-32498 | Medium | 5.9 | 2023-08-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Easy Form team Easy Form by AYS plugin <= 1.2.0 versions. |
CVE-2023-32107 | High | 7.1 | 2023-08-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.1.3 versions. |
CVE-2023-27414 | High | 7.1 | 2023-06-21 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin <= 3.4.4 versions. |
CVE-2023-2568 | Medium | 6.1 | 2023-06-12 | The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site… |
CVE-2023-2572 | Medium | 6.1 | 2023-06-05 | The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scrip… |
CVE-2023-2571 | Medium | 6.1 | 2023-06-05 | The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scrip… |
CVE-2023-23490 | High | 8.8 | 2023-01-20 | The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surv… |
CVE-2023-0038 | High | 7.2 | 2023-01-03 | The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and i… |
CVE-2022-1456 | Medium | 4.8 | 2022-05-30 | The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store… |
CVE-2022-1013 | Critical | 9.8 | 2022-05-09 | The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement an… |
CVE-2022-0641 | Medium | 6.1 | 2022-03-28 | The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a… |
CVE-2021-26256 | Medium | 4.7 | 2022-02-21 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6). |
CVE-2021-24931 | Critical | 9.8 | 2021-12-06 | The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file… |
CVE-2021-24651 | High | 7.5 | 2021-10-11 | The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not… |
CVE-2021-34635 | Medium | 6.1 | 2021-08-02 | The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-sett… |
CVE-2021-24484 | High | 7.2 | 2021-08-02 | The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderb… |
CVE-2021-24483 | High | 7.2 | 2021-08-02 | The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderb… |
CVE-2021-24463 | High | 8.8 | 2021-08-02 | The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the order… |
CVE-2021-24462 | High | 8.8 | 2021-08-02 | The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whi… |
CVE-2021-24461 | High | 8.8 | 2021-08-02 | The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL sta… |
CVE-2021-24460 | High | 8.8 | 2021-08-02 | The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter befor… |
CVE-2021-24459 | High | 8.8 | 2021-08-02 | The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before us… |
CVE-2021-24458 | High | 8.8 | 2021-08-02 | The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby para… |
CVE-2021-24457 | High | 8.8 | 2021-08-02 | The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-a… |
CVE-2021-24456 | High | 7.2 | 2021-08-02 | The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leadi… |
CVE-2016-10921 | Critical | 9.8 | 2019-08-22 | The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection. |