7.1Alta

CVE-2024-39656WordPress Tin Canny Reporting for LearnDash plugin <= 4.3.0.7 - Reflected Cross Site Scripting (XSS) vulnerability

Uncanny Owl Tin Canny Reporting for LearnDash Publicada: 2024-08-02 00:47 (hace 2 años)

Descripción

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Tin Canny Reporting for LearnDash allows Reflected XSS.This issue affects Tin Canny Reporting for LearnDash: from n/a through 4.3.0.7.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Uncanny Owl	Tin Canny Reporting for LearnDash	≤ 4.3.0.7

Referencias y parches

https://patchstack.com/database/vulnerability/tin-canny-learndash-reporting/wordpress-tin-canny-reporting-for… vdb-entry

Puntuación CVSS

7.1Alta

Fuente: Patchstack · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Requerida
Alcance: Cambiado
Confidencialidad: Bajo
Integridad: Bajo
Disponibilidad: Bajo

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS (probabilidad de explotación en 30 días)

0.30%

superior al 23 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2024-06-26
Publicada2024-08-02 00:47
Llegó a IP-DB2026-10-24 23:57
Última actualización2026-04-28 19:10

Asignada por (CNA): Patchstack

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — WordPress plugins & themes

Sin puntuación

CVE-2026-127048 hace 3 horas

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…

Sin puntuación

CVE-2026-124673 hace 3 horas

Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclo…

Sin puntuación

CVE-2026-124671 hace 3 horas

Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather th…

Sin puntuación

CVE-2026-123707 hace 3 horas

WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

WPGraphQL

The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.

Sin puntuación

CVE-2026-114452 hace 3 horas

Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Client Secret Disclosure and Payment Method Manipulation via IDOR

Membership Plugin

The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card payment request belongs to the user making it, allowing subscriber-level members to disclose another member's Stripe payment client secret and …

Sin puntuación

CVE-2026-114451 hace 3 horas

Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter

Membership Plugin

The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6…