1951 matches found
CVE-2020-4046 Authenticated XSS through embed block in WordPress
In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...
PT-2020-3639 · WordPress · Wordpress
Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.4.2 WordPress versions 5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34 Description: The issue is related to the embed block in t...
CVE-2020-7642
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...
CVE-2020-7642
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...
Design/Logic Flaw
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...
CVE-2020-7642
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...
CVE-2020-7642
CVE-2020-7642 affects lazysizes up to version 5.2.0, where the video-embed plugin fails to sanitize attributes data-vimeo, data-vimeoparams, data-youtube, and data-ytparams, enabling injection of malicious JavaScript. The vulnerability is tied to how untrusted payloads can be executed through the...
Cross-site Scripting (XSS)
Overview lazysizes is a fast jank-free, SEO-friendly and self-initializing lazyloader for images including responsive images picture/srcset, iframes, scripts/widgets and much more. It also prioritizes resources by differentiating between crucial in view and near view elements to make perceived...
Cross-Site Scripting
Overview Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if...
Server-Side Request Forgery (SSRF)
ghost is vulnerable to server-side request forgery SSRF. An attacker with the publisher role editor, author, contributor, administrator in a blog is able to exploit the vulnerability in the embed content module to make arbitrary GET requests in a on behalf of the server, allowing discovery of...
Cross-Site Scripting (XSS)
lazysizes is vulnerable to cross-site scripting XSS. The attributes data-vimeo, data-vimeoparams, data-youtube and data-ytparams are not sanitized by the video-embed plugin, allowing a remote attacker to inject and execute arbitrary Javascript in the user's browser via the affected parameters...
Jetpack 5.1-7.9 - Vulnerability in Shortcode Embed Code
The Jetpack – WP Security, Backup, Speed, & Growth WordPress plugin was affected by a Vulnerability in Shortcode Embed Code security vulnerability...
Advantech WISE-PaaS/RMM WechatSignin wechattokenlogin XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WISE-PasS/RMM. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WechatSignin class. Due to the improper restriction of XML External...
The vulnerability of the pcpu_embed_first_chunk() function in the Linux operating system allows a hacker to gain unauthorized access to certain information.
The vulnerability of the pcpuembedfirstchunk function in the Linux operating system’s kernel relates to the ability to read data from the dmesg output of the printk"pages / cpu" command. Exploiting this vulnerability can allow an intruder to gain unauthorized access to sensitive information...
WordPress embed-comment-images plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. embed-comment-images is a plugin that supports embedding image links in comments. A cross-site scripting vulnerability exists in the...
CVE-2017-18561
The embed-comment-images plugin before 0.6 for WordPress has XSS...
CVE-2017-18561
The CVE-2017-18561 entry concerns the WordPress plugin embed-comment-images with an XSS vulnerability in versions before 0.6. Connected sources consistently describe Cross-Site Scripting in this plugin, evidenced by references noting XSS and a PoC demonstrating an image tag-based vector (e.g., un...
WordPress Real Estate Theme 2.8.9 Cross Site Scripting
Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Date: 2019/07/20 Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...
WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting
WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Date: 2019/07/20 Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...
