CyberSecBulletin

TODO vulnerabilities

We track 2 vulnerabilities in TODO products across 5 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2022.

2vulnerabilities
0critical
2high
0exploited
8.0average CVSS score

Latest TODO vulnerabilities

  • 7.1 High severity

    Woo Billingo Plus: Cross-Site Request Forgery

    CVE-2022-3154TODO

    The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which coul

  • 8.8 High severity

    Advanced Custom Fields: Unrestricted Upload of File with Dangerous Type

    CVE-2022-2594TODOEPSS 1.61%

    The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form availab