Filtered by vendor Mekshq Subscriptions
Filtered by product Meks Easy Photo Feed Widget Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-24958 1 Mekshq 1 Meks Easy Photo Feed Widget 2024-08-03 5.4 Medium
The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site Scripting payloads in them
CVE-2023-25989 1 Mekshq 10 Meks Audio Player, Meks Easy Ads Widget, Meks Easy Maps and 7 more 2024-08-02 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.