| Package | Affected versions | Patched versions |
|---|---|---|
| ultimate faq | < 2.1.2 | 2.1.2 |
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free