Advisories · Technology
gVectors wpDiscuz.
Every CVE that names gVectors wpDiscuz among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass
- gVectors wpDiscuz
- CWE-799
- CVSS 5.3 Medium
wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage
- gVectors wpDiscuz
- Cross-site request forgery (CSRF)
- CVSS 2.1 Low
wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs
- gVectors wpDiscuz
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag
- gVectors wpDiscuz
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient
- gVectors wpDiscuz
- CWE-20
- CVSS 6.9 Medium
wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext
- gVectors wpDiscuz
- Information disclosure
- CVSS 6.1 Medium
wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email
- gVectors wpDiscuz
- Cross-site request forgery (CSRF)
- CVSS 6.9 Medium
wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()
- gVectors wpDiscuz
- CWE-348
- CVSS 9.2 CriticalCritical · CVSS 9+
wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
- gVectors wpDiscuz
- SQL injection
- CVSS 5.3 Medium
wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview
- gVectors wpDiscuz
- Cross-site scripting (XSS)
- CVSS 8.7 High
wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType
- gVectors wpDiscuz
- Broken access control