10websocial deserialization injection vulnerability

Versions 1.5.6 and earlier of 10websocial contain a deserialization injection vulnerability. This vulnerability stems from PHP object injection under Contributor privileges...

10WebSocial < 1.2.9 - Reflected XSS

The plugin does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page with the code below The XSS will be triggered when pressing...