Vulnerabilities and security researches forultimate-dashboard ultimate-dashboard
Direction: ascendingJun 07, 2024
Ultimate Dashboard – Custom WordPress Dashboard # CVE-2023-2812
- CVE, Research URL
- Date
- Jun 19, 2023
- Research Description
- The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Ultimate Dashboard – Custom WordPress Dashboard # CVE-2023-4726
- CVE, Research URL
- Date
- Nov 22, 2023
- Research Description
- The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7. due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Ultimate Dashboard – Custom WordPress Dashboard # CVE-2023-50828
- CVE, Research URL
- Date
- Dec 21, 2023
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Vongries Ultimate Dashboard – Custom WordPress Dashboard allows Stored XSS.This issue affects Ultimate Dashboard – Custom WordPress Dashboard: from n/a through 3.7.11.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Ultimate Dashboard – Custom WordPress Dashboard # 748b99f5a50d9d2f8c37cdf375b8915b27dc3d4a
- CVE, Research URL
- Date
- May 21, 2023
- Research Description
- Ultimate Dashboard – Custom WordPress Dashboard [ultimate-dashboard] < 3.7.6 Ultimate Dashboard <= 3.7.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Ultimate Dashboard – Custom WordPress Dashboard # CVE-2023-49822
- CVE, Research URL
- Date
- Jun 04, 2024
- Research Description
- Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Vongries Ultimate Dashboard allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ultimate Dashboard: from n/a through 3.7.10.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Mar 27, 2025
Ultimate Dashboard – Custom WordPress Dashboard # CVE-2025-2276
- CVE, Research URL
- Date
- Mar 26, 2025
- Research Description
- The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_module_actions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Apr 25, 2025
Ultimate Dashboard – Custom WordPress Dashboard # CVE-2025-1525
- CVE, Research URL
- Date
- Apr 17, 2025
- Research Description
- The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Ultimate Dashboard – Custom WordPress Dashboard # CVE-2025-1524
- CVE, Research URL
- Date
- Apr 17, 2025
- Research Description
- The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Ultimate Dashboard – Custom WordPress Dashboard # CVE-2025-1523
- CVE, Research URL
- Date
- Apr 17, 2025
- Research Description
- The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
Min -, max -.
- Status
-
vulnerable