Amasty

amasty

4 CVEs • 2 products

Products (2)

Click to collapse

Toggle

Amasty Blog Pro

amasty_blog_pro

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-36433 1Amasty 1Amasty Blog Pro Jun 17, 2026 Nov 29, 2022 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users v...Show more The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.Show less
CVE-2022-35501 1Amasty 1Blog Pro Jul 9, 2026 Nov 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function.
CVE-2022-35500 1Amasty 1Blog Pro Jul 9, 2026 Nov 23, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.
CVE-2022-36432 1Amasty 1Blog Pro Jun 17, 2026 Nov 17, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview ap...Show more The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks on admin panel users by manipulating the generated preview application response.Show less