MainWP Vulnerabilities and Affected Products
Vulnerabilities associated with MainWP Dashboard: Self-hosted WordPress Management for Agencies.
Products
Clear product- MainWP Child Reports3 vulnerabilities
- MainWP Dashboard: Self-hosted WordPress Management for Agencies3 vulnerabilities
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites2 vulnerabilities
- MainWP Code Snippets Extension2 vulnerabilities
- MainWP1 vulnerability
- MainWP Broken Links Checker Extension1 vulnerability
- MainWP Child1 vulnerability
- MainWP Dashboard -The Private WordPress Manager for Multiple Website Maintenance Plugin1 vulnerability
- MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance1 vulnerability
- MainWP File Uploader Extension1 vulnerability
- MainWP Google Analytics Extension1 vulnerability
- MainWP Links Manager Extension1 vulnerability
- MainWP Maintenance Extension1 vulnerability
- MainWP Matomo Extension1 vulnerability
- MainWP Staging Extension1 vulnerability
- MainWP UpdraftPlus Extension1 vulnerability
- MainWP Wordfence Extension1 vulnerability
- mainwp_file_uploader_extension1 vulnerability
- mainwp_links_manager_extension1 vulnerability
- mainwp_updraftplus_extension1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2016-15041HIGH | MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site ScriptingThe MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | CVSS7.2v3.1 | EPSS1.26% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-1642MEDIUM | MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulkThe MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CWE-352Mar 13, 2024 | CVSS4.3v3.1 | EPSS0.303% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS InjectionThe MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary CSS values into the site tags. | CVSS2.2v3.1 | EPSS0.395% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |