CVE-2022-2543

MEDIUM Year: 2022
CVSS v3 Score
6.1
Medium
Weakness Type
CWE-862
View all →

Vulnerability Description

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts

Related Vulnerabilities

CVE-2020-10746

MEDIUM
CVSS:6.1(Medium)

A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to ...

CWE-8622020

CVE-2021-20733

MEDIUM
CVSS:6.1(Medium)

Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット (asken diet) for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitr...

CWE-8622021

CVE-2021-20834

MEDIUM
CVSS:6.1(Medium)

Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1 allows a remote attacker to lead a ...

CWE-8622021

CVE-2021-24977

MEDIUM
CVSS:6.1(Medium)

The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then...

CWE-8622021

CVE-2023-39507

MEDIUM
CVSS:6.1(Medium)

Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to lead the vulnerable App to access an arbitrary website.

CWE-8622023

CVE-2024-23388

MEDIUM
CVSS:6.1(Medium)

Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulner...

CWE-8622024