Filtered by vendor Wp-championship Project Subscriptions
Filtered by product Wp-championship Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-1967 1 Wp-championship Project 1 Wp-championship 2024-11-21 6.5 Medium
The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
CVE-2015-5308 1 Wp-championship Project 1 Wp-championship 2024-11-21 N/A
Multiple SQL injection vulnerabilities in cs_admin_users.php in the wp-championship plugin 5.8 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user, (2) isadmin, (3) mail service, (4) mailresceipt, (5) stellv, (6) champtipp, (7) tippgroup, or (8) userid parameter.