CVE-2023-0233 ActiveCampaign < 8.1.12 - Contributor+ Stored XSS

The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0233 ActiveCampaign < 8.1.12 - Contributor+ Stored XSS

The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0233

CVE-2023-0233 affects the ActiveCampaign WordPress plugin for versions prior to 8.1.12. The flaw: block options are not validated/escaped before output, enabling Stored XSS for users with contributor+ privileges when the block is embedded on a page/post. Patch available: update to version 8.1.12 ...

WordPress plugin ActiveCampaign 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress ActiveCampaign Plugin < 8.1.12 is vulnerable to Cross Site Scripting (XSS)

Software ActiveCampaign Type Plugin Vulnerable versions 8.1.12 Fixed in 8.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0233 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 463ed36d88c8 Credits István Márton...

ActiveCampaign < 8.1.12 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a contributor, add a "AC Forms" Gutenberg block ...

ActiveCampaign < 8.1.12 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks As a contributor, add a "AC Forms" Gutenberg block to a...

CVE-2022-3923

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs...

CVE-2022-3923

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs...

Code injection

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs...

CVE-2022-3923 ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs...

CVE-2022-3923 ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup

The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs...

CVE-2022-3923

The CVE-2022-3923 issue affects the ActiveCampaign for WooCommerce WordPress plugin prior to version 1.9.8. The vulnerability is a missing authorization check when cleaning up error logs via an AJAX action, permitting any authenticated user (e.g., a subscriber) to invoke the action and remove err...

PT-2023-13715 · WordPress · Activecampaign For Woocommerce

Name of the Vulnerable Software and Affected Versions: ActiveCampaign for WooCommerce WordPress plugin versions prior to 1.9.8 Description: The issue concerns a lack of authorization check when cleaning up error logs via an AJAX action. This could allow any authenticated users, such as subscriber...

ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup

The plugin does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs. PoC Run the below command in the developer console of the web browser while being on the blog as a...

ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log Cleanup

The plugin does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs. Run the below command in the developer console of the web browser while being on the blog as a subscribe...

WordPress ActiveCampaign Email Preference Center plugin < 2.0.10 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress ActiveCampaign Email Preference Center plugin versions 2.0.10. Solution Update the WordPress ActiveCampaign Email Preference Center plugin to the latest available version at least 2.0.10...

WordPress ActiveCampaign Email Preference Center plugin < 2.0.10 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress ActiveCampaign Email Preference Center plugin versions 2.0.10. Solution Update the WordPress ActiveCampaign Email Preference Center plugin to the latest available version at least 2.0.10...

Wordpress ActiveCampaign Cross-Site Request Forgery Vulnerability

Wordpress ActiveCampaign is Wordpress open source an application plugin . The WordPress ActiveCampaign plugin, versions before 8.0.2 suffers from a cross-site request forgery vulnerability that stems from a lack of CSRF checks, which can be exploited by an attacker to exploit an account's API...

CVE-2021-24133

Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account...