633 matches found
Schema & Structured Data for WP & AMP < 1.24 - Contributor+ Stored XSS
Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...
WordPress Schema & Structured Data for WP & AMP Plugin <= 1.23 is vulnerable to Cross Site Scripting (XSS)
Software Schema & Structured Data for WP & AMP Type Plugin Vulnerable versions = 1.23 Fixed in 1.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51677 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c9c204c67d47 Credits LVT-tholv2k Requir...
AMP for WP – Accelerated Mobile Pages < 1.0.92.1 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
Description The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
WordPress AMP for WP Plugin <= 1.0.92 is vulnerable to Cross Site Scripting (XSS)
Software AMP for WP Type Plugin Vulnerable versions = 1.0.92 Fixed in 1.0.92.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-6782 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID da4cbf06b8b4 Credits N/A Required privilege Contributor...
CVE-2023-5210
CVE-2023-5210 affects AMP+ Plus WordPress plugin version
WordPress plugin AMP+ Plus security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
CVE-2023-48321
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP – Accelerated Mobile Pages: from n/a through 1.0.88.1...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP – Accelerated Mobile Pages: from n/a through 1.0.88.1...
CVE-2023-48321
CVE-2023-48321 concerns the AMP for WP – Accelerated Mobile Pages plugin for WordPress. The issue is an Improper Neutralization of Input During Web Page Generation, i.e., a Stored XSS vulnerability affecting AMP for WP versions up to 1.0.88.1 (vendor: AMP for WP). The root cause is stored XSS via...
CVE-2023-48321 WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP – Accelerated Mobile Pages: from n/a through 1.0.88.1...
WordPress Plugin AMP for WP Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress AMP for WP Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)
Software AMP for WP Type Plugin Vulnerable versions = 1.0.88.1 Fixed in 1.0.89 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-48321 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b9382afe26c0 Credits Ngô Thiên An ancorn from VNPT-VCI...
Scattered Spider
SUMMARY The Federal Bureau of Investigation FBI and Cybersecurity and Infrastructure Security Agency CISA are releasing this joint Cybersecurity Advisory CSA in response to recent activity by Scattered Spider threat actors against the commercial facilities sectors and subsectors. This advisory...
WordPress AMP+ Plus Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)
Software AMP+ Plus Type Plugin Vulnerable versions = 3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5210 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dc153061411b Credits Nicolas Surribas Required...
AMP+ Plus <= 3.0 - Reflected Cross Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin https://example.com/?p=1&yolo=%22%3E%3CScRiPt%3Ealert%28%27XSS%27%29%3C%2FsCrIpT%3E...
AMP+ Plus <= 3.0 - Reflected Cross Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC https://example.com/?p=1=%22%3E%3CScRiPt%3Ealert%28%27XSS%27%29%3C%2FsCrIpT%3E...
Advisory ROSA-SA-2023-2285
software: clamav 0.103.8 WASP: ROSA-CHROME packageevrstring: clamav-0.103.8-1.src.rpm CVE-ID: CVE-2022-20698 BDU-ID: 2022-00587 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability in the Clam AntiVirus software package is related to insufficient input validation. Exploitation of the vulnerability could...
CVE-2023-45831
Cross-Site Request Forgery CSRF vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin = 1.5.15 versions...