Anycomment
by Bologer
CVEs (3)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-0134 | Hig | 0.57 | 8.8 | 0.01 | Feb 21, 2022 | The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack | ||
| CVE-2021-24838 | Med | 0.40 | 6.1 | 0.02 | Jan 17, 2022 | The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature. | ||
| CVE-2018-21001 | Med | 0.40 | 6.1 | 0.01 | Aug 27, 2019 | The anycomment plugin before 0.0.33 for WordPress has XSS. |
- risk 0.57cvss 8.8epss 0.01
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
- risk 0.40cvss 6.1epss 0.02
The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
- risk 0.40cvss 6.1epss 0.01
The anycomment plugin before 0.0.33 for WordPress has XSS.