CVE-2022-1564 Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2022-13963

Name of the Vulnerable Software and Affected Versions The Form Maker by 10Web WordPress plugin versions prior to 1.14.12 Description The issue concerns the lack of proper sanitization and escaping of the Custom Text settings in the plugin. This could allow high-privilege users, such as admins, to...

Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed In a form settings, put the following payload in the Actions after submission Action Type Custom Tex...

Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC In a form settings, put the following payload in the Actions after submission Action Type Custom...

WordPress Form Maker by 10Web plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Abhinav Porwal & Hitesh Kumar in WordPress Form Maker by 10Web plugin versions = 1.14.11. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.14.12...

WordPress Photo Gallery by 10Web plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Photo Gallery by 10Web plugin is vulnerable to a cross-site scripting vulnerability that stems from...

CVE-2022-1282

CVE-2022-1282 affects the WordPress plugin Photo Gallery by 10Web (before 1.6.3). The issue is a reflected XSS: $_GET['image_url'] is not sanitized and is echoed back in the editimage_bwg AJAX action. This can allow script execution via a crafted image_url payload. Remediation is upgrading to ver...

PT-2022-13771

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web WordPress plugin versions prior to 1.6.3 Description The issue arises from the improper sanitization of the image url variable in the $ GET request, which is reflected back to users during the execution of the...

WordPress Photo Gallery by 10Web plugin <= 1.6.2 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by JrXnm in WordPress Photo Gallery by 10Web plugin versions = 1.6.2. Solution Update the WordPress Photo Gallery by 10Web plugin to the latest available version at least 1.6.3...

WordPress Photo Gallery by 10Web plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Photo Gallery by 10Web plugin version 1.6.0...

CVE-2022-0169

The CVE concerns the WordPress plugin Photo Gallery by 10Web (versions before 1.6.0). The vulnerability is an SQL injection in admin-ajax.php via bwg_tag_id_bwg_thumbnails_0 in the bwg_frontend_data action, exploitable by unauthenticated users. Root cause: lack of validation/escaping of the bwg_t...

CVE-2022-0169: Improper Neutralization of Special Elements used in an SQL Command

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection...

Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection

The plugin does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection PoC...

Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection

The plugin does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection...

PT-2022-7047

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web WordPress plugin versions prior to 1.6.0 Description The issue is related to a lack of validation and escaping of the bwg tag id bwg thumbnails 0 parameter in SQL statements via the /wp-admin/admin-ajax.php endpoint,...

WordPress 10Web Social Photo Feed Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress 10Web Social Photo Feed Plugin has a cross-site scripting vulnerability in versions prior to 1.4.29, which stems...

CVE-2021-25047

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...

CVE-2021-25047 10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...

CVE-2021-25047

CVE-2021-25047 – 10Web Social Photo Feed Plugin : WordPress plugin versions before 1.4.29 are vulnerable to a reflected Cross-Site Scripting (XSS) on the wdi_apply_changes admin page, enabling an attacker to execute JavaScript in the context of any logged-in user. Root cause cited: lack of data v...

CVE-2021-25047: Improper Neutralization of Input During Web Page Generation

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...