Tipsandtricks-Hq
75 CVEs across 18 Tipsandtricks-Hq products. Browse Tipsandtricks-Hq vulnerabilities, severities, and proof-of-concept exploits.
Tipsandtricks-Hq products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3890 | Medium | 6.4 | 2025-05-01 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all version… |
CVE-2025-3889 | Medium | 5.3 | 2025-05-01 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the '… |
CVE-2025-3874 | Medium | 6.5 | 2025-05-01 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to la… |
CVE-2024-6136 | Medium | 5.4 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users pe… |
CVE-2024-6134 | Medium | 5.4 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-6133 | Medium | 6.5 | 2024-08-12 | The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-5081 | Medium | 6.1 | 2024-08-05 | The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow atta… |
CVE-2024-5285 | Medium | 5.5 | 2024-07-29 | The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logge… |
CVE-2024-6076 | Medium | 6.1 | 2024-07-15 | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-6075 | High | 8.8 | 2024-07-15 | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users pe… |
CVE-2024-6074 | Medium | 6.1 | 2024-07-15 | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-6073 | Medium | 6.1 | 2024-07-15 | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Ref… |
CVE-2024-6072 | Medium | 6.1 | 2024-07-15 | The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute… |
CVE-2024-5744 | Medium | 6.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead… |
CVE-2024-5715 | High | 7.1 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-5287 | High | 7.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2024-5286 | Medium | 4.8 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-5284 | Medium | 6.8 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-5283 | Medium | 6.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-5282 | Medium | 6.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-5281 | Medium | 6.1 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-5280 | Medium | 4.7 | 2024-07-13 | The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could a… |
CVE-2024-5080 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the ser… |
CVE-2024-5079 | Medium | 6.1 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perf… |
CVE-2024-5077 | Medium | 6.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-5076 | High | 8.8 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted ac… |
CVE-2024-5075 | Medium | 5.9 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-5074 | Medium | 5.4 | 2024-07-13 | The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-4749 | High | 8.3 | 2024-06-04 | The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflecte… |
CVE-2023-6497 | Medium | 4.4 | 2024-01-27 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up… |
CVE-2022-47588 | Medium | 6.7 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery s… |
CVE-2023-22685 | Medium | 5.9 | 2023-05-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.2 version… |
CVE-2023-22691 | Medium | 4.3 | 2023-05-03 | Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions. |
CVE-2023-1469 | Medium | 4.4 | 2023-03-17 | The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including… |
CVE-2023-1431 | Medium | 5.3 | 2023-03-16 | The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin savi… |
CVE-2023-0275 | Medium | 5.4 | 2023-02-13 | The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in… |
CVE-2022-4672 | Medium | 5.4 | 2023-01-23 | The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in t… |
CVE-2022-4542 | Medium | 5.4 | 2023-01-23 | The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4465 | Medium | 5.4 | 2023-01-16 | The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-3898 | High | 8.8 | 2022-11-29 | The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or i… |
CVE-2022-3897 | Medium | 5.5 | 2022-11-29 | The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due… |
CVE-2022-3896 | Medium | 6.1 | 2022-11-29 | The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6… |
CVE-2022-3822 | Medium | 4.8 | 2022-11-28 | The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-44737 | Medium | 6.5 | 2022-11-22 | Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress. |
CVE-2022-2189 | Medium | 6.1 | 2022-07-25 | The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which coul… |
CVE-2022-2194 | Medium | 4.8 | 2022-07-17 | The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to per… |
CVE-2022-1695 | Medium | 4.3 | 2022-06-08 | The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged i… |
CVE-2021-25102 | Medium | 4.7 | 2022-05-02 | The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redire… |
CVE-2021-24692 | Medium | 6.5 | 2022-03-14 | The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as wp-con… |
CVE-2021-24696 | High | 8.8 | 2022-01-24 | The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins… |
CVE-2021-24694 | Medium | 5.4 | 2022-01-24 | The Simple Download Monitor WordPress plugin before 3.9.11 could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attack vi… |
CVE-2021-24698 | Medium | 4.3 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, e… |
CVE-2021-24697 | Medium | 6.1 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date PO… |
CVE-2021-24695 | High | 7.5 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place… |
CVE-2021-24693 | Critical | 9.0 | 2021-11-08 | The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow… |
CVE-2021-24799 | Medium | 4.3 | 2021-11-01 | The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in adm… |
CVE-2021-24735 | Medium | 6.5 | 2021-10-18 | The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Di… |
CVE-2021-24734 | Medium | 5.4 | 2021-10-18 | The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Cont… |
CVE-2021-24711 | High | 8.8 | 2021-10-11 | The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF… |
CVE-2021-24560 | Medium | 6.1 | 2021-09-13 | The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the a… |
CVE-2021-24665 | Medium | 5.4 | 2021-08-30 | The WP Video Lightbox WordPress plugin before 1.9.3 does not escape the attributes of its shortcodes, allowing users with a role as low as contributor to perfo… |
CVE-2021-20782 | High | 8.8 | 2021-07-14 | Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of adm… |
CVE-2020-29171 | Medium | 6.1 | 2021-02-10 | Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-sec… |
CVE-2020-5651 | High | 8.8 | 2020-10-21 | SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL. |
CVE-2020-5650 | Medium | 6.1 | 2020-10-21 | Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors. |
CVE-2019-5993 | High | 8.8 | 2019-09-12 | Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authe… |
CVE-2016-10888 | Critical | 9.8 | 2019-08-14 | The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues. |
CVE-2016-10887 | Critical | 9.8 | 2019-08-14 | The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues. |
CVE-2015-9310 | Critical | 9.8 | 2019-08-14 | The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues. |
CVE-2016-10867 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages. |
CVE-2016-10866 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues. |
CVE-2016-10868 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages. |
CVE-2015-9294 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances. |
CVE-2015-9293 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature. |
CVE-2013-2705 | | 2014-05-13 | Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin before 3.6 for WordPress allows remote attackers to hijack… |