CVE-2022-26366

CVE-2022-26366 affects the WordPress AdRotate Banner Manager Plugin, specifically versions <= 5.9. It describes a CSRF/XSRF vulnerability that can enable an attacker to perform privileged actions (e.g., password changes) under a user’s authentication. The issue is tied to ads/banner management...

WordPress plugin AdRotate Banner Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2022-17814 · WordPress · Adrotate Banner Manager Plugin

Name of the Vulnerable Software and Affected Versions: AdRotate Banner Manager Plugin versions = 5.9 Description: The issue is related to Cross-Site Request Forgery CSRF in the AdRotate Banner Manager Plugin on WordPress. Recommendations: For AdRotate Banner Manager Plugin versions = 5.9, update ...

CVE-2022-26366: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in AdRotate Banner Manager Plugin = 5.9 on WordPress...

AdRotate Banner Manager < 5.9.1 - Password Change via CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make a logged admin change their password via CSRF attacks...

WordPress AdRotate Banner Manager plugin <= 5.9 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities leading to resetting some of the maintenance settings Reset tasks, Disable the third party, Update Database were discovered by Muhammad Daffa Patchstack Alliance in the WordPress AdRotate Banner Manager plugin versions = 5.9. Solution...

WordPress AdRotate plugin cross-site scripting vulnerability (CNVD-2022-59803)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23. The...

WordPress AdRotate plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23, which st...

CVE-2022-0649

The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0662

The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0662

The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0649

The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0662

The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0649

The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0662 Adrotate < 5.8.23 - Admin+ XSS via Advert Name

The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0662

CVE-2022-0662 affects the WordPress AdRotate plugin prior to 5.8.23. The vulnerability arises because Advert Names are not properly sanitized/escaped, enabling a high-privilege user to perform Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed. The issue is ...

CVE-2022-0649 Adrotate < 5.8.23 - Admin+ XSS via Group Name

The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0649

The AdRotate WordPress plugin (versions prior to 5.8.23) fails to escape Group Names, enabling Cross-Site Scripting (XSS) by highly privileged users even when unfiltered_html is disallowed. The vulnerability stems from insufficient escaping in group name handling. Public sources (including Red Ha...