4.3Orta

CVE-2024-4689WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability

ShortPixel ShortPixel Adaptive Images Yayım: 2024-05-10 11:23 (2 yıl önce)

Açıklama

Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.

Zayıflık türü (CWE): CWE-352

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
ShortPixel	ShortPixel Adaptive Images	≤ 3.8.3

Kaynaklar ve yamalar

https://patchstack.com/database/Wordpress/Plugin/shortpixel-adaptive-images/vulnerability/wordpress-shortpixe… vdb-entry

CVSS puanı

4.3Orta

Kaynak: Patchstack · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS (30 günde istismar olasılığı)

0.25%

tüm CVE'lerin %16'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2024-05-09
Yayımlandı2024-05-10 11:23
IP-DB'ye ulaştı2026-10-24 23:57
Son güncelleme2026-05-12 23:29

Numarayı veren (CNA): Patchstack

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

9.8Kritik

CVE-2026-125795 1 saat önce

WordPress Estatik plugin <= 4.3.6 - Local File Inclusion vulnerability

Estatik Estatik

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through 4.3.6.

7.1Yüksek

CVE-2026-125793 1 saat önce

WordPress Flexmls® IDX plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

flexmls Flexmls® IDX

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Reflected XSS.This issue affects Flexmls® IDX: from n/a through 4.1.2.

7.1Yüksek

CVE-2026-125765 1 saat önce

WordPress ShortPixel Adaptive Images plugin <= 3.11.6 - Cross Site Scripting (XSS) vulnerability

ShortPixel ShortPixel Adaptive Images

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Stored XSS.This issue affects ShortPixel Adaptive Images: from n/a through 3.11.6.

7.1Yüksek

CVE-2026-128893 1 saat önce

WordPress Wise Chat plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability

Marcin Wise Chat

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Reflected XSS.This issue affects Wise Chat: from n/a through 3.4.5.

7.5Yüksek

CVE-2026-125799 1 saat önce

WordPress Flow-Flow Social Stream plugin <= 5.0.5 - Sensitive Data Exposure vulnerability

Looks Awesome Flow-Flow Social Stream

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Looks Awesome Flow-Flow Social Stream flow-flow-social-streams allows Retrieve Embedded Sensitive Data.This issue affects Flow-Flow Social Stream: from n/a throug…

7.2Yüksek

CVE-2026-125771 1 saat önce

WordPress MCP Server for WordPress plugin <= 2.0.3 - Privilege Escalation vulnerability

AtlasAiDev MCP Server for WordPress

Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.3.