Vulnerabilidades do Wpdirectorykit Sweet Energy Efficiency
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Wpdirectorykit Sweet Energy Efficiency: 2 registro(s), com versões afetadas e correções.
CVE-2025-14618
Média · 4.3
CWE-862 18/12/2025
Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion
The Sweet Energy Efficiency plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on the 'sweet_energy_efficiency_action' AJAX handler in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with subscriber level access and above, to read, modify, and delete arbitrary graphs.
CVE-2025-58262
Alta · 7.1
CWE-352 22/09/2025
WordPress Sweet Energy Efficiency plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPDirectoryKit Sweet Energy Efficiency sweet-energy-efficiency allows Stored XSS.This issue affects Sweet Energy Efficiency: from n/a through <= 1.0.8.