Vulnerabilities and security researches foriq-block-country

CVE, Research URL: CVE-2022-1762
Home page URL: Security reports for iQ Block Country
Application: iQ Block Country
Date: Jun 13, 2022
Research Description: The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
Affected versions: max 1.1.20.
Status: vulnerable

CVE, Research URL: CVE-2021-36873
Home page URL: Security reports for iQ Block Country
Application: iQ Block Country
Date: Sep 23, 2021
Research Description: Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: &blockcountry_blockmessage.
Affected versions: max 1.2.12.
Status: vulnerable

CVE, Research URL: CVE-2022-41155
Home page URL: Security reports for iQ Block Country
Application: iQ Block Country
Date: Nov 19, 2022
Research Description: Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.
Affected versions: max 1.1.20.
Status: vulnerable

CVE, Research URL: CVE-2022-0246
Home page URL: Security reports for iQ Block Country
Application: iQ Block Country
Date: Apr 11, 2022
Research Description: The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
Affected versions: max 1.2.13.
Status: vulnerable

Vulnerabilities and security researches foriq-block-country iq-block-country