WordPress Social Gallery and Widget plugin <= 2.2.5 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Social Gallery and Widget plugin versions = 2.2.5. Solution Update the WordPress Social Gallery and Widget plugin to the latest available version at least 2.3...

WordPress Catch Import Export plugin <= 1.8 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Import Export plugin versions = 1.8. Solution Update the WordPress Catch Import Export plugin to the latest available version at least 1.9...

WordPress Catch Web Tools plugin <= 2.6.6 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Web Tools plugin versions = 2.6.6. Solution Update the WordPress Catch Web Tools plugin to the latest available version at least 2.7...

Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting

The plugin does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks. Put the following payload in the QR setting: "alert/XSS/ The XSS will be triggered in the plugin's...

CVE-2021-24618: Improper Neutralization of Input During Web Page Generation

The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting XSS. Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated...

WordPress Catch Sticky Menu plugin <= 1.6.3 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Sticky Menu plugin versions = 1.6.3. Solution Update the WordPress Catch Sticky Menu plugin to the latest available version at least 1.7...

WordPress Header Enhancement plugin <= 1.4.3 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Header Enhancement plugin versions = 1.4.3. Solution Update the WordPress Header Enhancement plugin to the latest available version at least 1.5...

WordPress Catch Under Construction plugin <= 1.3.4 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Under Construction plugin versions = 1.3.4. Solution Update the WordPress Catch Under Construction plugin to the latest available version at least 1.4...

WordPress Catch Infinite Scroll plugin <= 1.8.1 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Infinite Scroll plugin versions = 1.8.1. Solution Update the WordPress Catch Infinite Scroll plugin to the latest available version at least 1.9...

CVE-2021-37912

The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in...

Compact WP Audio Player < 1.9.7 - Setting Change via CSRF

The plugin does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack. PoC...

EFB Tampering. Approach and Landing Performance Part 2

Approach and Landing Performance Part 2: Approach Speeds, Cold Weather Corrections, Sources of Data Click here for part 1 Target: Approach speed calculation The speed at which aircraft fly on approach depends on a variety of factors including: Aircraft weight Flap setting Wind direction/speed Fin...

CVE-2021-24619

The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues...

CVE-2021-24619 Per Page Add to Head <= 1.4.4 - Authenticated Stored XSS

The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues...

CVE-2021-24588

The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting XSS vulnerability in the plugin's setting page...

CVE-2021-24591

The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24588 SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting

The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting XSS vulnerability in the plugin's setting page...

PT-2021-16104

Name of the Vulnerable Software and Affected Versions SMS Alert Order Notifications WordPress plugin versions prior to 3.4.7 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability is located in the plugin's setting page, which could allow an attacker to...

CVE-2021-24588: Improper Neutralization of Input During Web Page Generation

The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting XSS vulnerability in the plugin's setting page...

GHSA-JJ53-8FMW-F2W2 Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.

Impact Unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where: - the vulnerable homeserver is in the room; and - untrusted users are permitted to create groups communities. By defaul...