8715 matches found
CVE-2021-24467
The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the...
CVE-2021-24502
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users, even when the unfilteredhtml capability is disallowed...
CVE-2021-24502 WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users, even when the unfilteredhtml capability is disallowed...
CVE-2021-24502
CVE-2021-24502 affects the WordPress WP Google Map plugin prior to 1.7.7. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitization/escaping of the Map Title in output, exploitable by high-privilege users. Impact is stored XSS, with no unfiltered_html requi...
CVE-2021-24467
The CVE-2021-24467 affects the Leaflet Map WordPress plugin prior to 3.0.0. The root cause is that the plugin does not verify the CSRF nonce when saving its settings, enabling a logged-in attacker to perform a CSRF and update settings. This can lead to stored Cross-Site Scripting by changing the ...
CVE-2021-24467: Cross-Site Request Forgery (CSRF)
The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress WP Google Map Plugin versions prior to 1.7.7, which...
WordPress Plugin Leaflet Map 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2021-24502: Improper Neutralization of Input During Web Page Generation
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users, even when the unfilteredhtml capability is disallowed...
PT-2021-15992 · WordPress · Leaflet Map
Name of the Vulnerable Software and Affected Versions: Leaflet Map WordPress plugin versions prior to 3.0.0 Description: The issue allows attackers to make a logged-in admin update the plugin's settings via a Cross-Site Request Forgery attack because it does not verify the CSRF nonce when saving...
CVE-2021-24468
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues...
Cross site scripting
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues...
CVE-2021-24468
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues...
CVE-2021-24468 Leaflet Map < 3.0.0 - Contributor+ Stored XSS
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues...
CVE-2021-24468
CVE-2021-24468 affects the WordPress Leaflet Map plugin up to version 3.0.0, where shortcode attributes are not escaped before use in JavaScript/HTML, enabling stored XSS by users with as low as Contributor. Impact is stored XSS; remediation is to update to v3.0.0 or newer (per provided records).
CVE-2021-24468: Improper Neutralization of Input During Web Page Generation
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
PT-2021-15993
Name of the Vulnerable Software and Affected Versions Leaflet Map WordPress plugin versions prior to 3.0.0 Description The issue allows users with a role as low as Contributors to exploit stored XSS issues due to the plugin not escaping some shortcode attributes before they are used in JavaScript...
PT-2021-27684
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash has been reported with an unknown read type. The crash state involves a std:: 1:: tree and a std:: 1::map, indicating an issue with a C++ standar...