plugin records

14 published records for vendor plugin.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

14 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2023-28659No exploit	The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcplugin · waiting · CWE-89 SQL injection	High8.8	—	0.9%	Mar 22, 2023
26Monitor	CVE-2023-1865No exploit	YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Resetplugin · yourchannel · CWE-862 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.7%	Apr 5, 2023
21Monitor	CVE-2023-1868No exploit	YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Resetplugin · yourchannel · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.6%	Apr 5, 2023
21Monitor	CVE-2022-4833No exploit	YourChannel: Everything you want in a YouTube plugin < 1.2.3 - Contributor+ Stored XSS via Shortcodeplugin · yourchannel · CWE-79 XSS	Medium5.4	—	0.6%	Feb 6, 2023
21Monitor	CVE-2023-0282No exploit	YourChannel < 1.2.2 - Subscriber+ Stored XSSplugin · yourchannel · CWE-79 XSS	Medium5.4	—	0.5%	Feb 6, 2023
21Monitor	CVE-2023-2757No exploit	Waiting: One-click countdowns <= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scriptingplugin · waiting · CWE-862 Broken access control (IDOR) XSS	Medium5.4	—	0.5%	May 17, 2023
19Monitor	CVE-2023-1869No exploit	YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scriptingplugin · yourchannel · CWE-79 XSS	Medium4.8	—	0.5%	Apr 5, 2023
19Monitor	CVE-2022-4954No exploit	Waiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site Scriptingplugin · waiting · CWE-79 XSS	Medium4.8	—	0.3%	Oct 20, 2023
17Monitor	CVE-2023-3999No exploit	Waiting: One-click countdowns <= 0.6.2 - Missing Authorizationplugin · waiting · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.4%	Aug 31, 2023
17Monitor	CVE-2023-1870No exploit	YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Updateplugin · yourchannel · CWE-352 Pre-auth CSRF	Medium4.3	—	0.3%	Apr 5, 2023
17Monitor	CVE-2023-1867No exploit	YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Changeplugin · yourchannel · CWE-352 Pre-auth CSRF	Medium4.3	—	0.3%	Apr 5, 2023
17Monitor	CVE-2023-1866No exploit	YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Resetplugin · yourchannel · CWE-352 Pre-auth CSRF	Medium4.3	—	0.3%	Apr 5, 2023
17Monitor	CVE-2023-1871No exploit	YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Resetplugin · yourchannel · CWE-352 Pre-auth CSRF	Medium4.3	—	0.3%	Apr 5, 2023
17Monitor	CVE-2023-4000No exploit	Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgeryplugin · waiting · CWE-352 Pre-auth CSRF	Medium4.3	—	0.2%	Aug 31, 2023

CVE-2023-28659
35Monitor
The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
plugin · waitingMar 22, 2023
CVE-2023-1865
26Monitor
YourChannel <= 1.2.3 - Missing Authorization to Plugin Settings Reset
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
plugin · yourchannelApr 5, 2023
CVE-2023-1868
21Monitor
YourChannel <= 1.2.3 - Missing Authorization to Plugin Cache Reset
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
plugin · yourchannelApr 5, 2023
CVE-2022-4833
21Monitor
YourChannel: Everything you want in a YouTube plugin < 1.2.3 - Contributor+ Stored XSS via Shortcode
MediumCVSS 5.4No exploitEPSS 1%
- XSS
plugin · yourchannelFeb 6, 2023
CVE-2023-0282
21Monitor
YourChannel < 1.2.2 - Subscriber+ Stored XSS
MediumCVSS 5.4No exploitEPSS 1%
- XSS
plugin · yourchannelFeb 6, 2023
CVE-2023-2757
21Monitor
Waiting: One-click countdowns <= 0.6.2 - Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting
MediumCVSS 5.4No exploitEPSS 0%
- Broken access control (IDOR)
- XSS
plugin · waitingMay 17, 2023
CVE-2023-1869
19Monitor
YourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
plugin · yourchannelApr 5, 2023
CVE-2022-4954
19Monitor
Waiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site Scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
plugin · waitingOct 20, 2023
CVE-2023-3999
17Monitor
Waiting: One-click countdowns <= 0.6.2 - Missing Authorization
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
plugin · waitingAug 31, 2023
CVE-2023-1870
17Monitor
YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Update
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
plugin · yourchannelApr 5, 2023
CVE-2023-1867
17Monitor
YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Settings Change
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
plugin · yourchannelApr 5, 2023
CVE-2023-1866
17Monitor
YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Channel Reset
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
plugin · yourchannelApr 5, 2023
CVE-2023-1871
17Monitor
YourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation Reset
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
plugin · yourchannelApr 5, 2023
CVE-2023-4000
17Monitor
Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgery
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
plugin · waitingAug 31, 2023