421 matches found
CVE-2023-46093 WordPress Webmaster Tools Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in LionScripts.Com Webmaster Tools plugin = 2.0 versions...
PT-2023-29820 · Xqueue Gmbh · Maileon
Name of the Vulnerable Software and Affected Versions: XQueue GmbH Maileon for WordPress plugin versions = 2.16.0 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious...
PT-2023-28033 · Presspage Entertainment Inc. · Smarty
Name of the Vulnerable Software and Affected Versions: PressPage Entertainment Inc. Smarty for WordPress plugin versions 3.1.35 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject...
PT-2023-27193 · Unknown · Wsecure Lite
Name of the Vulnerable Software and Affected Versions: Ajay Lulia wSecure Lite plugin versions = 2.5 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious scripts into the...
PT-2023-26495 · Visualmodo · Visualmodo Borderless Plugin
Name of the Vulnerable Software and Affected Versions: Visualmodo Borderless plugin versions = 1.4.8 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious scripts into the...
CVE-2020-11711
An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possibl...
Authentication flaw
An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possibl...
CVE-2020-11711
An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possibl...
CVE-2023-29387 WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Julien Crego Manager for Icomoon plugin = 2.0 versions...
PT-2023-23705 · Getbutton.Io · Getbutton Chat Button
Name of the Vulnerable Software and Affected Versions: GetButton Chat Button by GetButton.Io plugin versions 1.8.9.4 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin privileges can inject...
Xenforo Version 2.2.13 - Authenticated Stored XSS
Exploit Title: Xenforo Version 2.2.13 - Authenticated Stored XSS Date: 2023-06-24 Exploit Author: Furkan Karaarslan Category : Webapps Vendor Homepage: https://x.com/admin.php?smilies Version: 2.2.12 REQUIRED Tested on: Windows/Linux CVE :...
NEX-Forms < 8.4.4 - Authenticated Stored XSS
The plugin does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins in multisite / admins in single site can create forms, however there is a settings allowing them to give lower roles access to such feature. PoC Create a new form with the...
CVE-2023-32239 WordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. subscriber+ Stored Cross-Site Scripting XSS vulnerability in xtemos WoodMart theme = 7.2.1 versions...
WordPress 5.4.x < 5.4.13 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A directory traversal via wplang. CVE-2023-2745 - A Cross-Site Request Forgery CSRF via wpajaxsetattachmentthumbnail. - An authenticated stored Cross-Site Scripting XSS vi...
WordPress bbPress Plugin < 2.6.5 Multiple Vulnerabilities
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:bbpress:bbpress"; if description...
PT-2023-19150 · Miniorange · Miniorange Wordpress Social Login/Register
Name of the Vulnerable Software and Affected Versions: miniOrange WordPress Social Login and Register plugin versions prior to 7.5.14 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject...
PT-2023-13996 · Unknown · Shareaholic Similar Posts
Name of the Vulnerable Software and Affected Versions: Shareaholic Similar Posts plugin versions 3.1.6 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into t...
PT-2023-19882 · Kiboko · Kiboko Labs Arigato Autoresponder/Newsletter
Name of the Vulnerable Software and Affected Versions: Kiboko Labs Arigato Autoresponder and Newsletter plugin versions = 2.7.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject...
CVE-2023-23821 WordPress Interactive Polish Map Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marcin Pietrzak Interactive Polish Map plugin = 1.2 versions...
