Imageinject

imageinject

Vendor: Wpscoop • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-4243 1Wpscoop 1Imageinject Jun 17, 2026 Dec 26, 2022 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltere...Show more The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).Show less
CVE-2018-5285 1Wpscoop 1Imageinject Nov 21, 2024 Jan 8, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.
CVE-2018-5284 1Wpscoop 1Imageinject Nov 21, 2024 Jan 8, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.