CVE-2023-0585

The CVE-2023-0585 entry concerns the WordPress All in One SEO Pack plugin, affected up to version 4.2.9. The root cause is insufficient input sanitization and output escaping that enables Stored Cross-Site Scripting (XSS). The attack requires Administrator privileges and user interaction, allowin...

CVE-2023-0585

The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above...

CVE-2023-0585 All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above...

PT-2023-16384 · WordPress · All In One Seo Pack

Name of the Vulnerable Software and Affected Versions: All in One SEO Pack plugin for WordPress versions up to, and including, 4.2.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

WordPress Plugin All in One SEO Pack 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2023-16385 · WordPress · All In One Seo Pack

Name of the Vulnerable Software and Affected Versions: All in One SEO Pack plugin for WordPress versions up to, and including, 4.2.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS

The plugin does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers PoC Make a logged in admin open the below URL using web browser which does not encode characters...

VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS

The plugin does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Make a logged in admin open the below URL using web browser which does not encode characters...

WordPress VK All in One Expansion Unit Plugin <= 9.87.0.1 is vulnerable to Cross Site Scripting (XSS)

Software VK All in One Expansion Unit Type Plugin Vulnerable versions = 9.87.0.1 Fixed in 9.87.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID c3722e6e8342 Credits WordFence...

Schema - All In One Schema Rich Snippets < 1.6.6 - Multiple CSRF

The plugin does not properly validate a user intended to do an action, which they could have done using nonce checks. This makes it possible for attackers to conduct CSRF attacks against an unsuspecting administrator, tricking their browser into editing some of the plugin's settings...

WordPress Cart All In One For WooCommerce Plugin <= 1.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Cart All In One For WooCommerce Type Plugin Vulnerable versions = 1.1.10 Fixed in 1.1.11 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46806 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4f842f506d26 Credits C...

CVE-2022-2546

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...

CVE-2022-2546 All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...

CVE-2022-2546 All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS

The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...

CVE-2022-2546

The CVE-2022-2546 issue affects WordPress All-in-One WP Migration plugin &lt; 7.63. The vulnerability arises from using the wrong content type and not properly escaping the ai1wm_export response, enabling an attacker to craft a request that, when submitted by a visitor, injects arbitrary HTML/Jav...

WordPress Plugin All-in-One WP Migration 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2022-4346

The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...

CVE-2022-4346 All In One WP Security & Firewall < 5.1.3 - Configuration Leak

The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...

CVE-2022-4346 All In One WP Security & Firewall < 5.1.3 - Configuration Leak

The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...

CVE-2022-4346

The CVE-2022-4346 issue affects the All-In-One Security (AIOS) WordPress plugin (versions prior to 5.1.3). The underlying problem is an information disclosure: plugin settings, including the email address, were leaked publicly. Public references and security feeds document an exposure vector tied...