944 matches found
CVE-2022-1603
The CVE-2022-1603 entry corresponds to a CSRF vulnerability in the WordPress Mail Subscribe List plugin, versions prior to 2.1.4. The exposed component is the delete-subscription action, where there is no CSRF check, allowing an authenticated administrator to be coerced into removing arbitrary su...
WordPress plugin Mail Subscribe List 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. cross-site request forgery vulnerability exists in versions of the WordPress Mail Subscribe List plugin...
CVE-2022-1792
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them...
CVE-2022-1792
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them...
CVE-2022-1792
The CVE-2022-1792 entry affects the WordPress Quick Subscribe plugin (versions up to 1.7.1). It describes a CSRF flaw in settings updates that can permit a logged-in attacker to alter settings, with Stored XSS risk due to insufficient sanitisation/escaping. Root cause: absence of CSRF checks and ...
WordPress plugin Quick Subscribe 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
CVE-2017-20035
A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of the component Subscribe. The manipulation leads to cross site scripting Persistent. The attack may be initiated remotely. Upgrading to...
CVE-2017-20035 PHPList Subscribe Persistent cross site scriting
A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of the component Subscribe. The manipulation leads to cross site scripting Persistent. The attack may be initiated remotely. Upgrading to...
WordPress Mail Subscribe List plugin <= 2.1.3 - Arbitrary Subscribed User Deletion via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Subscribed User Deletion via Cross-Site Request Forgery CSRF vulnerability was discovered by Daniel Ruf in the WordPress Mail Subscribe List plugin versions = 2.1.3. Solution Update the WordPress Mail Subscribe List plugin to the latest available version at least 2.1.4...
Mail Subscribe List < 2.1.4 - Arbitrary Subscribed User Deletion via CSRF
The plugin does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list document.getElementById"test".submit;...
Mail Subscribe List < 2.1.4 - Arbitrary Subscribed User Deletion via CSRF
The plugin does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list PoC...
Quick Subscribe <= 1.7.1 - Arbitrary Settings Update via CSRF to Stored XSS
The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them PoC...
WordPress Quick Subscribe plugin <= 1.7.1 - Arbitrary Settings Update via CSRF leading to Stored XSS vulnerability
Arbitrary Settings Update via CSRF to Stored XSS vulnerability discovered by Daniel Ruf in WordPress Quick Subscribe plugin versions = 1.7.1. Solution Deactivate and delete. This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full...
WordPress WP Subscribe plugin cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Subscribe plugin version 1.2.12 and earlier versions have a cross-site scripting...
WordPress Subscribe To Comments Reloaded plugin cross-site request forgery vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Subscribe To Comments Reloaded plugin 211130 and earlier versions are vulnerable to cross-site...
CVE-2021-36844
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in MyThemeShop WP Subscribe plugin = 1.2.12 on WordPress...
CVE-2021-36844
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in MyThemeShop WP Subscribe plugin = 1.2.12 on WordPress...
CVE-2021-36844 WordPress WP Subscribe plugin <= 1.2.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in MyThemeShop WP Subscribe plugin = 1.2.12 on WordPress...
CVE-2021-36844 WordPress WP Subscribe plugin <= 1.2.12 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in MyThemeShop WP Subscribe plugin = 1.2.12 on WordPress...