Tiempo

tiempo

3 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-2272 1Tiempo 1Tiempo Jun 17, 2026 Aug 16, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege...Show more The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminShow less
CVE-2023-2271 1Tiempo 1Tiempo Jun 17, 2026 Aug 16, 2023 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow attackers to make logged in admins delete arbitrary shortcode via a CSRF attack
CVE-2023-0058 1Tiempo 1Tiempo Jun 17, 2026 Aug 16, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Sto...Show more The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attackShow less