WordPress Custom Add User Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Custom Add User Type Plugin Vulnerable versions = 2.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0043 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID c948921589af Credits Shreya Pohekar Required...

CVE-2023-0043

The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-0043 Custom Add User <= 2.0.2 - Reflected Cross-Site Scripting

The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-0043 Custom Add User <= 2.0.2 - Reflected Cross-Site Scripting

The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-15969

Name of the Vulnerable Software and Affected Versions Custom Add User WordPress plugin versions prior to 2.0.3 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

CVE-2023-0043: Improper Neutralization of Input During Web Page Generation

The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Plugin Custom Add User 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2022-37403

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Nikhil Vaghela's Add User Role plugin = 0.0.1 at WordPress...

CVE-2022-37403

CVE-2022-37403 affects the WordPress Add User Role plugin (versions

CVE-2022-37403: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Nikhil Vaghela's Add User Role plugin = 0.0.1 at WordPress...

WordPress plugin Add User Role 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Add User Role plugin <= 0.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by ptsfence Patchstack Alliance in WordPress Add User Role plugin versions = 0.0.1. Solution Deactivate and delete. This plugin has been closed as of August 29, 2022 and is not available for download. This closure is temporary...

Cross-site Scripting (XSS)

keycloak-wildfly-adduser is vulnerable to cross-site scripting. The vulnerability exists due to lack of escape in Add use parameter which allows a remote attacker to inject and execute malicious javascript into the system...

CVE-2021-39394

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...

PT-2022-10908

Name of the Vulnerable Software and Affected Versions mm-wiki version 0.2.1 Description The issue allows attackers to perform Cross-Site Request Forgery CSRF attacks, enabling them to arbitrarily add user accounts and modify user information. Recommendations For mm-wiki version 0.2.1, consider...

CVE-2021-39394: Cross-Site Request Forgery (CSRF)

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...

OAS Engine SecureAddUser Unauthorized Access

The vulnerability of the OAS Engine SecureAddUser function on the platform for data transfer between devices and applications is related to the lack of authentication checks for this critical function. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized...

CVE-2022-26303

An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of an OAS user account. An attacker can send a sequence of requests to trigge...

Stored Cross Site Scripting on "Add user" field

Steps to reproduce: 1. Go to settings-- Access controls -- Add user 2. Payload = """ 3. Add XSS payload as username and create a new user 4. After creating the user, click on delete button and the XSS will be triggered POC Screenshot:...

Webmin Cross-Site Scripting Vulnerability (CNVD-2022-61348)

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.A cross-site scripting vulnerability exists in Webmin version 1.973, which stems from the lack of filtering and escaping of user-submitted parameters for the Add User feature. An...