Wpvar

wpvar

3 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-0335 1Wpvar 1Wp Shamsi Jun 17, 2026 Mar 27, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The WP Shamsi WordPress plugin through 4.3.3 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber delete attachment.
CVE-2022-4555 1Wpvar 1Wp Shamsi Jun 17, 2026 Dec 16, 2022 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible fo...Show more The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.Show less
CVE-2022-38058 1Wpvar 1Wp Shamsi Jun 17, 2026 Sep 9, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.