{"error":0,"message":null,"data":{"name":"WP Armour &#8211; Honeypot Anti Spam","plugin":"honeypot","link":"https:\/\/wordpress.org\/plugins\/honeypot\/","latest":"1788456480","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"83c5310bc5f9993c46911b34eab84195631a713b2b49285be6212813d17d7cdb","name":"WP Armour &#8211; Honeypot Anti Spam [honeypot] < 1.5.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.5.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"ea3e0197bc542ee5fe735235370f667fc1e3dbd1","name":"WordPress WP Armour \u2013 Honeypot Anti Spam plugin <= 1.5.6 - Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/honeypot\/vulnerability\/wordpress-wp-armour-honeypot-anti-spam-plugin-1-5-6-cross-site-scripting-xss-vulnerability","description":"Cross-Site Scripting (XSS) vulnerability found in WordPress WP Armour \u2013 Honeypot Anti Spam plugin (versions <= 1.5.6).","date":"2021-02-08"}],"impact":[]},{"uuid":"36bde16d69d85216cdf84b27910ce23f2f6d0d50851b7aff7d12f5afdb161d23","name":"WP Armour &#8211; Honeypot Anti Spam [honeypot] < 1.5.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.5.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"ae2c63a44ebf4c45cefcd05f5821c94ecda15f09","name":"WP Armour Honeypot Anti Spam <= 1.5.6 -Cross-Site Request Forgery to Arbitrary Options Update","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/honeypot\/wp-armour-honeypot-anti-spam-156-cross-site-request-forgery-to-arbitrary-options-update","description":"The Armour Honeypot Anti Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the wpa_save_settings() function in versions up to, and including, 1.5.6. This makes it possible for attackers to modify arbitrary site options granted they can trick an administrator into performing an action such as clicking on a link.","date":"2021-02-08"}],"impact":[]},{"uuid":"bb4ffd3436c3fad7c984713b05e6c1c2d64eb95e3683823ee85f74f2e8ecf0b6","name":"WP Armour &#8211; Honeypot Anti Spam [honeypot] < 1.5.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.5.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"fe403a7f-99ed-4cb3-9000-1d1f3cc98f1a","name":"WP Amour &lt; 1.5.7 - Authenticated Stored Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/fe403a7f-99ed-4cb3-9000-1d1f3cc98f1a","description":"The plugin did not sanitise and escape its setting fields, leading to Stored Cross-Site Scripting issues. Furthermore, the lack of CSRF checks could also allow attackers to trigger the XSS via CSRF attacks against a logged in administrator","date":null}],"impact":[]},{"uuid":"32862d2a7b94365cff66fb98d29bc535d101728f0ff363aa283962e102c8343a","name":"WP Armour &#8211; Honeypot Anti Spam [honeypot] < 2.1.14","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.14","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-29091","name":"CVE-2024-29091","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-29091","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dnesscarkey WP Armour \u2013 Honeypot Anti Spam allows Reflected XSS.This issue affects WP Armour \u2013 Honeypot Anti Spam: from n\/a through 2.1.13.","date":"2024-03-19"},{"id":"c575e88849c414ea2eb78e8c1b0e4ad51210a754","name":"WordPress  WP Armour \u2013 Honeypot Anti Spam Plugin    <= 2.1.13 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/honeypot\/vulnerability\/wordpress-wp-armour-plugin-2-1-13-reflected-cross-site-scripting-xss-vulnerability","description":"Update the WordPress WP Armour \u2013 Honeypot Anti Spam plugin to the latest available version (at least 2.1.14).\nRafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Armour \u2013 Honeypot Anti Spam Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 2.1.14.\nThis vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.\nHave additional information or questions about this entry? Get in touch.","date":null},{"id":"f371f1cef6c2ddfba4a7ee3060decb6890e169a1","name":"WP Armour \u2013 Honeypot Anti Spam <= 2.1.13 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/honeypot\/wp-armour-honeypot-anti-spam-2113-reflected-cross-site-scripting","description":"The WP Armour \u2013 Honeypot Anti Spam plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2024-03-15"},{"id":"7e342eea-f966-4e63-b09b-8b2802c3ba00","name":"WP Armour &lt; 2.1.14 - Reflected XSS","link":"https:\/\/wpscan.com\/vulnerability\/7e342eea-f966-4e63-b09b-8b2802c3ba00","description":"The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"2.8","impact":"3.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"3.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1767321376"}