Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bernhard Kux JSON Content Importer plugin = 1.3.15 versions...

CVE-2023-25793 WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in George Pattihis Link Juice Keeper plugin = 2.0.2 versions...

CVE-2022-47608

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Quick Contact Form plugin = 8.0.3.1 versions...

CVE-2023-25484

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Oliver Schlöbe Simple Yearly Archive plugin = 2.1.8 versions...

CVE-2023-25479

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Podlove Podlove Subscribe button plugin = 1.3.7 versions...

CVE-2023-25710

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin = 1.4.0 versions...

PT-2023-12549 · Odoo · Odoo Community +1

Name of the Vulnerable Software and Affected Versions: Odoo Community version 15.0 Odoo Enterprise version 15.0 Description: A sandboxing issue allows authenticated administrators to execute arbitrary code, leading to privilege escalation. Recommendations: For Odoo Community version 15.0, update ...

ChurchCRM 跨站请求伪造漏洞

ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM version v4.5.3. An attacker exploited the vulnerability to set a person as a user and set that user as an administrator...

CVE-2022-41612

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Shareaholic Similar Posts plugin = 3.1.6 versions...

CVE-2022-47598

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Plugins Pro WP Super Popup plugin = 1.1.2 versions...

CVE-2022-47158

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Pakpobox alfred24 Click & Collect plugin = 1.1.7 versions...

PT-2023-15421 · WordPress · Wp Super Popup

Name of the Vulnerable Software and Affected Versions: WP Super Popup plugin versions = 1.1.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the WP Super Popup plugin. This vulnerability requires authentication with admin+ privileges...

CVE-2023-23816 WordPress Sitemap Index Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Cross-Site Scripting XSS vulnerability in Twardes Sitemap Index plugin = 1.2.3 versions...

CVE-2022-44594

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Codebangers All in One Time Clock Lite plugin = 1.3.320 versions...

CVE-2022-45361 WordPress 0mk Shortener Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Boris Kuzmanov 0mk Shortener plugin = 0.2 versions...

PT-2023-21252 · Unknown · Ian Haycox Motor Racing League

Name of the Vulnerable Software and Affected Versions: Ian Haycox Motor Racing League plugin versions prior to 1.9.9 Description: The issue is related to an Authenticated admin+ Cross-Site Scripting XSS vulnerability. This means that an attacker who has administrative access to the system can...

PT-2023-21114 · Unknown · James Irving-Swift Electric Studio Client Login

Name of the Vulnerable Software and Affected Versions: James Irving-Swift Electric Studio Client Login plugin versions prior to 0.8.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with admin+ authentication. This type of vulnerability allo...

Vulnerabilities fixed in VMWare Aria Operations or Logs (vh: vrealize Log Insight)

VMWare has fixed vulnerabilities in Aria Operations for Logs, formerly known as vRealize Log Insight. A malicious person with access to the log server can exploit the vulnerabilities exploit them to execute arbitrary code as root. The malicious party can gain access without prior authentication...

CVE-2023-22894

Strapi through 4.5.5 allows attackers with access to the admin panel to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then th...

CVE-2022-44632: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin = 1.1.13 versions...