NdkAdvancedCustomizationFields vulnerabilities
4 known CVE vulnerabilities in NdkAdvancedCustomizationFields, translated and rated.
- CVE-2022-40842Critical
The NdkAdvancedCustomizationFields plugin version 3.5.0 for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via the rotateimg.php file. An attacker can exploit this to send requests from the server to internal network resources.
- CVE-2022-40841Medium
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the 'htmlNodes' parameter.
- CVE-2022-40840Medium
The NdkAdvancedCustomizationFields 3.5.0 plugin for ndk design is vulnerable to Cross-Site Scripting (XSS) in the createPdf.php file. This allows an attacker to inject malicious JavaScript code into the page.
- CVE-2022-40839High
A SQL injection vulnerability in the height and width parameters in NdkAdvancedCustomizationFields v3.5.0 allows unauthenticated attackers to exfiltrate database data.