CVE-2023-2224

The SEO by 10Web WordPress plugin before 1.2.7 is vulnerable to Stored XSS due to insufficient sanitisation/escaping of settings. High-privilege users (admin) could exploit this—even when unfiltered_html is disallowed in multisite environments. Affected versions:

CVE-2023-2503 10WebSocial < 1.2.9 - Reflected XSS

The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2503

CVE-2023-2503 affects the 10Web Social Post Feed WordPress plugin (pre-1.2.9). Root cause: the plugin does not sanitize/escape certain parameters before output, enabling a Reflected XSS under admin contexts. Impact per sources: MEDIUM (CVSS 3.1 base 6.1). Remediation: upgrade to plugin version 1....

CVE-2023-2503 10WebSocial < 1.2.9 - Reflected XSS

The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2117

CVE-2023-2117 affects the WordPress plugin Image Optimizer by 10web (versions before 1.0.27). The issue comes from the plugin not sanitizing the dir parameter during the get_subdirs AJAX action, enabling high-privilege users (e.g., admins) to enumerate file and directory names outside the site ro...

WordPress Seo By 10Web Plugin < 1.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Seo By 10Web Type Plugin Vulnerable versions 1.2.7 Fixed in 1.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2224 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7380d78d51b0 Credits Taurus Omar Required privileg...

WordPress 10Web Social Post Feed Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

Software 10Web Social Post Feed Type Plugin Vulnerable versions = 1.2.8 Fixed in 1.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 73c5db117428 Credits Unknown Required privileg...

Seo By 10Web < 1.2.7 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to SEO by 10Web » Sitemap section. 2. And n...

WordPress Image Optimizer by 10web Plugin < 1.0.27 is vulnerable to Cross Site Scripting (XSS)

Software Image Optimizer by 10web Type Plugin Vulnerable versions 1.0.27 Fixed in 1.0.27 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2122 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b135df868a4f Credits Phạm Ngọc Khá...

Image Optimizer by 10web < 1.0.27 - Admin+ Path Traversal

The plugin does not sanitize the dir parameter when handling the getsubdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root. - Payload: ../../../../../../../../../../../../../../../../../../../ - At the "Other...

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the iowdtabsactive parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link. PoC Make a logged in...

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the iowdtabsactive parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link. Make a logged in admin...

WordPress Image Optimizer by 10web Plugin < 1.0.27 is vulnerable to Directory Traversal

Software Image Optimizer by 10web Type Plugin Vulnerable versions 1.0.27 Fixed in 1.0.27 OWASP Top 10 A1: Injection Classification Directory Traversal CVE CVE-2023-2117 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID dd4f37114439 Credits Chien Vuong Required privilege...

WordPress Photo Gallery by 10Web Plugin < 1.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Photo Gallery by 10Web Type Plugin Vulnerable versions 1.8.3 Fixed in 1.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4058 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ee71d42f5999 Credits Krzysztof Zając...

WordPress Photo Gallery by 10Web Plugin < 1.8.15 is vulnerable to Directory Traversal

Software Photo Gallery by 10Web Type Plugin Vulnerable versions 1.8.15 Fixed in 1.8.15 OWASP Top 10 A6: Security Misconfiguration Classification Directory Traversal CVE CVE-2023-1427 Patch priority Low CVSS severity Low 6.8 Developer Claim ownership PSID f915d3bc46f4 Credits Nguyen Huu Do Require...

CVE-2023-1427

The CVE-2023-1427 entry describes a path traversal vulnerability in the WordPress plugin Photo Gallery by 10Web, affecting versions prior to 1.8.15. The root cause is that uploaded files were not consistently kept within the plugin’s intended uploads directory, allowing high-privilege users to pl...

CVE-2023-1427 Photo Gallery by 10Web < 1.8.15 - Admin+ Path Traversal

The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector...

WordPress Plugin Photo Gallery by 10Web 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Sql injection

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-0037 10WebMapBuilder < 1.0.73 - Unauthenticated SQLi

The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...