Vulnerabilities (CVE)

Filtered by vendor Webinarpress Subscribe
Total 3 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-11270 1 Webinarpress 1 Webinarpress 2025-01-17 N/A 8.8 HIGH
The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import-imgs' function and missing file type validation in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files that can lead to remote code execution.
CVE-2024-11271 1 Webinarpress 1 Webinarpress 2025-01-17 N/A 8.8 HIGH
The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing capability check on several functions in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify webinars.
CVE-2024-43339 1 Webinarpress 1 Webinarpress 2024-08-27 N/A 6.1 MEDIUM
Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20.