Internet Formation

internet-formation

5 CVEs • 2 products

Products (2)

Click to collapse

Toggle

Wp Advanced Search

wp-advanced-search

Modal Portfolio

modal_portfolio

CVEs (5)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-10554 1Internet Formation 1Wp Advanced Search Jun 17, 2026 Mar 25, 2025 N/A· v4 3.5 LOW· v3 N/A· v2 The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even...Show more The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).Show less
CVE-2024-13851 1Internet Formation 1Modal Portfolio Jun 17, 2026 Feb 28, 2025 N/A· v4 4.8 MEDIUM· v3 N/A· v2 The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for a...Show more The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.Show less
CVE-2024-9796 1Internet Formation 1Wp Advanced Search Jun 17, 2026 Oct 10, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
CVE-2022-47447 1Internet Formation 1Wp Advanced Search Jun 17, 2026 May 24, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.
CVE-2020-12104 1Internet Formation 1Wp Advanced Search Jun 17, 2026 May 5, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.