PT-2023-31878 · WordPress · Aam Advanced Access Manager

Name of the Vulnerable Software and Affected Versions: AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More versions n/a through 6.9.18 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability...

WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open Redirection

Software Advanced Access Manager Type Plugin Vulnerable versions = 6.9.18 Fixed in 6.9.19 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2023-51675 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 56c8b177a6e3 Credits LVT-tholv2k Required privilege Autho...

WordPress Advanced Access Manager Plugin <= 6.9.15 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Access Manager Type Plugin Vulnerable versions = 6.9.15 Fixed in 6.9.16 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50881 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d6fc616194fa Credits Ngô Thiên An ancorn from...

WordPress Advanced Access Manager Plugin < 6.8.0 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-24830

The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24830

The CVE concerns the WordPress plugin Advanced Access Manager (AAM) before version 6.8.0. The issue is that certain settings are not properly escaped when output, enabling Stored XSS by high-privilege users even when unfiltered_html is disallowed. Affected component: AAM WordPress plugin; root ca...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Advanced Access Manager, which stems from a...

PT-2021-16317 · WordPress · Aam Advanced Access Manager

Name of the Vulnerable Software and Affected Versions: Advanced Access Manager WordPress plugin versions prior to 6.8.0 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping some of its settings when outputting them, even when th...

Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in any of the plugin's settings with a text input: - v alert/XSS/ - v...

WordPress Advanced Access Manager plugin Handling Logic Error Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Advanced Access Manager plugin versions prior to 6.6.2,...

WordPress Advanced Access Manager plugin Access Control Error Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Advanced Access Manager plugin versions prior to 6.6.2...

CVE-2020-35934

The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object including all metadata upon login via the REST API aam/v1/authenticate or aam/v2/authenticate. This is a security problem if this object stores information that the user is not supposed to have e.g.,...

CVE-2020-35934

The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object including all metadata upon login via the REST API aam/v1/authenticate or aam/v2/authenticate. This is a security problem if this object stores information that the user is not supposed to have e.g.,...

CVE-2020-35935

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aamuserroles POST parameter if Multiple Role support is enabled. The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios...

Privilege escalation

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aamuserroles POST parameter if Multiple Role support is enabled. The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios...

CVE-2020-35935

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aamuserroles POST parameter if Multiple Role support is enabled. The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios...

CVE-2020-35935

CVE-2020-35935 affects WordPress Advanced Access Manager (AAM) plugin versions prior to 6.6.2. Affected component: the aam_user_roles parameter used during profile updates with Multiple Role support enabled. Root cause: the entitlement check for adding roles did not work correctly in various cust...

CVE-2020-35934

The WordPress Advanced Access Manager plugin (AAM) prior to version 6.6.2 discloses the unfiltered user object (including all metadata) upon login via REST API endpoints aam/v1/authenticate and aam/v2/authenticate. This exposes user data that may include custom metadata from other plugins, creati...

PT-2021-11868 · WordPress · Aam Advanced Access Manager

Name of the Vulnerable Software and Affected Versions: Advanced Access Manager plugin versions prior to 6.6.2 Description: The issue arises when the Advanced Access Manager plugin for WordPress displays the unfiltered user object, including all metadata, upon login via the REST API at endpoints...