| CVE/PSC | Application | Date | Affected versions | Description | Details |
|---|---|---|---|---|---|
| Actual on: Feb 11, 2025, 04:02:18 | Entries count: 2 | ||||
|
vulnerable
|
Dec 06, 2024, 06:12:42 |
Min -
Max 2.7.0
|
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swin-campaign' shortcode in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whene... | ||
|
vulnerable
|
Jan 05, 2025, 09:01:11 |
Min -
Max 2.8.0
|
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it possible for unauthenticated attackers to reset the plugin’s installation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | ||