Ultimate Faq

ultimate_faq

CVEs (5)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-24968 1Etoilewebdesign 1Ultimate Faq Nov 21, 2024 Jan 24, 2022 N/A· v4 5.7 MEDIUM· v3 3.5 LOW· v2 The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, a...Show more The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questionsShow less
CVE-2020-7107 1Etoilewebdesign 1Ultimate Faq Nov 21, 2024 Jan 16, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.
CVE-2019-17233 1Etoilewebdesign 1Ultimate Faq Nov 21, 2024 Oct 7, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
CVE-2019-17232 1Etoilewebdesign 1Ultimate Faq Nov 21, 2024 Oct 7, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
CVE-2019-15643 1Etoilewebdesign 1Ultimate Faq Nov 21, 2024 Aug 27, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.