Very Good Plugins Vulnerabilities and Affected Products
Vulnerabilities associated with WP Fusion Lite.
Products
Clear product- WP Fusion Lite3 vulnerabilities
- Fatal Error Notify1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-27972CRITICAL | WordPress WP Fusion Lite plugin <= 3.41.24 - Remote Code Execution (RCE) vulnerabilityImproper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through <= 3.41.24. | CVSS9.9v3.1 | EPSS1.63% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-34660MEDIUM | WP Fusion Lite <= 3.37.18 Reflected Cross-Site ScriptingThe WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18. CWE-79Aug 9, 2021 | CVSS6.1v3.1 | EPSS0.819% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-34661MEDIUM | WP Fusion Lite <= 3.37.18 Cross-Site Request Forgery to Data DeletionThe WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18. CWE-352Aug 9, 2021 | CVSS6.1v3.1 | EPSS0.45% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |