CVE-2022-1407

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS...

CVE-2019-7881

Magento 2.x suffers a cross-site scripting mitigation bypass in versions: 2.1 before 2.1.18, 2.2 before 2.2.9, and 2.3 before 2.3.2. An authenticated admin could exploit this to escalate privileges (admin vs admin XSS). Remediation per sources: apply the Magento security update for 2.1.18, 2.2.9,...