Cross site scripting

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24526

CVE-2021-24526 affects the WordPress plugin Form Maker (by 10Web) prior to version 1.13.60. The issue is an authenticated Stored XSS caused by not escaping the Form Title when outputting it in an HTML attribute while editing a form in the admin dashboard. Impact is limited to authenticated users ...

CVE-2021-24363

CVE-2021-24363 affects the WordPress plugin Photo Gallery by 10Web – Mobile-Friendly Image Gallery, prior to version 1.5.75. The vulnerability arises from improper enforcement that uploaded files stay within the plugin’s uploads folder, enabling a path traversal that could allow high-privilege us...

CVE-2021-24362 Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will b...

CVE-2021-24362

The CVE-2021-24362 entry concerns the WordPress plugin “Photo Gallery by 10Web – Mobile-Friendly Image Gallery” (older builds). Affected versions prior to 1.5.75 fail to sanitize uploaded SVG content, allowing a user who can add images to a gallery to upload an SVG containing JavaScript. When the...

WordPress plugin has an unspecified vulnerability (CNVD-2021-59599)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. Backup by 10Web WordPress Plugin 1.0.20 and earlier has...

Cross site scripting

The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue...

CVE-2021-24426

The CVE-2021-24426 issue affects the WordPress plugin Backup by 10Web – Backup and Restore (versions up to 1.0.20). The underlying flaw is failure to sanitize/escape the tab parameter before echoing it in the page, which enables a reflected Cross-Site Scripting (XSS) vulnerability. Several connec...

Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue PoC http://example.com/wp-admin/admin.php?page=buwdrestore=general%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain;%20m0ze...

Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue http://example.com/wp-admin/admin.php?page=buwdrestore&tab=general%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain;%20m0ze...

CVE-2021-24310

The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery i...

Cross site scripting

The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery i...

CVE-2021-24310

Affected product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin, vulnerable in versions before 1.5.67. Root cause: improper sanitisation of the gallery title, stemming from an incomplete fix of CVE-2019-16117. Impact: authenticated users with high privileges can inject X...

WordPress Form Maker by 10Web plugin <= 1.13.56 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by m0ze and Thura Moe Myint in WordPress Form Maker by 10Web plugin versions = 1.13.56. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.57...

WordPress Form Maker by 10Web plugin <= 1.13.56 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze and Thura Moe Myint in WordPress Form Maker by 10Web plugin versions = 1.13.56. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.57...

Cross site scripting

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting XSS issues via the galleryid, tag, albumid and id GET parameters passed to the bwgfrontenddata AJAX action available to both unauthenticated and authenticat...

CVE-2021-24291 Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting XSS issues via the galleryid, tag, albumid and id GET parameters passed to the bwgfrontenddata AJAX action available to both unauthenticated and authenticated...

CVE-2021-24291

WordPress Photo Gallery by 10Web (plugin before 1.5.69) contains reflected XSS flaws in bwg_frontend_data, exploitable by unauthenticated or authenticated users via GET parameters such as gallery_id, tag, album_id and theme_id. The XSS can execute script in the victim’s browser (impact: script ex...

WordPress Photo Gallery 1.5.69 Cross Site Scripting

Researcher Name: ThuraMoeMyint Twitter: https://twitter.com/mgthuramoemyint Vendor Url: https://wordpress.org/plugins/photo-gallery/ "Photo Gallery by 10Web / Mobile-Friendly Image Gallery" photo-gallery Multiple RXSS The parameter bwgalbumbreadcrumb0 is able to inject malicious javascript code...

WordPress Photo Gallery 1.5.69 Cross Site Scripting Vulnerability

WordPress Photo Gallery plugin versions 1.5.69 and below suffer from multiple reflective cross site scripting vulnerabilities. WordPress Photo Gallery 1.5.69 Cross Site Scripting Vulnerability Researcher Name: ThuraMoeMyint Twitter: https://twitter.com/mgthuramoemyint Vendor Url:...