Easy Fancybox < 1.8.18 - Authenticated Stored XSS

The Easy FancyBox WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...

Opencart 3.x - Cross-Site Scripting

Opencart 3.x - Cross-Site Scripting Exploit Title: Opencart 3.x.x Authenticated Stored XSS Date: 08/15/2019 Exploit Author: Nipun Somani Author Web: http://thehackerstore.net Vendor Homepage: https://www.opencart.com/ Software Link: https://github.com/opencart/opencart Version: 3.x.x Tested on:...

Additional Variation Images for WooCommerce < 1.1.29 - Authenticated Stored XSS

The Additional Variation Images Gallery for WooCommerce WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...

CVE-2019-14797

The CVE-2019-14797 entry concerns the WordPress plugin Photo Gallery by 10Web (WordPress, prior to version 1.5.23). The vulnerability is an authenticated stored XSS in the plugin, as stated across multiple connected sources. In practical terms, an authenticated attacker could inject malicious scr...

Yoast SEO 1.2.0-11.5 - Authenticated Stored XSS

The vendor's description, reference included below: "Yoast SEO 11.6 also fixes a security issue regarding term pages in WordPress. Unfiltered code was allowed in some fields. This, however, does not pose a problem for single user sites. In specific cases, on multisite installs, this might become ...

WebP Express <= 0.14.4 - Authenticated Stored XSS

Edit - WPScanTeam: The reported issue has been fixed in 0.14.5. Other sanitisation checks have been implemented in newest versions such as 0.14.6 and 0.14.8 while the plugin was closed, so the fixed in is set to 0.14.8 PoC Video POC :...

WP Ultimate Recipe <= 3.12.6 - Authenticated Stored XSS

The WP Ultimate Recipe WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...

KingComposer - Authenticated Stored XSS

An user with the Contributor or Author privileges can inject arbitrary Javascript code in a KC section. When an admin or editor opens the malicious KC section the arbitrary JS code runs...

WordPress CarSpot theme <= 2.1.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by QUIXSS in WordPress CarSpot theme versions = 2.1.6. Solution Update the WordPress CarSpot theme to the latest available version at least 2.1.7...

CVE-2018-17288

Kofax Front Office Server version 4.1.1.11.0.5212 both Thin Client and Administration Console suffers from multiple authenticated stored XSS vulnerabilities via the 1 "Filename" field in /Kofax/KFS/ThinClient/document/upload/ - Thin Client or 2 "DeviceName" field in...

CarSpot Theme <= 2.1.6 - Authenticated Stored XSS

Bad input field data filtering has been discovered in the 'CarSpot – Automotive Car Dealer Wordpress Classified Theme'. Current version of this Premium Theme is 2.1.5. PoC Authorize on the demo website for tests: https://carspot.scriptsbundle.com/, login is [email protected] and passow...

WordPress Jetpack plugin <= 6.4.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by RIPS Technologies in WordPress Jetpack plugin versions = 6.4.2. Solution Update the WordPress Jetpack plugin to the latest available version at least 6.5...

WooCommerce <= 3.4.5 - Authenticated Stored XSS

The WooCommerce WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...

WordPress Jibu Pro plugin <= 1.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Renos Nikolaou in WordPress Jibu Pro plugin versions = 1.7. Solution 2018.09.01 - we were unable to find a patched version of this plugin. Last time updated seven years ago. We recommend to deactivate and delete it...

Cross site scripting

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...

CVE-2018-11330

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...

CVE-2018-10326

PrinterOn Enterprise 4.1.3 is affected by multiple authenticated stored XSS vulnerabilities: (1) department field in printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest. No remediation or exploit details are p...

CVE-2018-10259

An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...

Geist WatchDog Console 3.2.2 XSS / XML Injection / Insecure Permissions

Exploit Author: bzyo CVE: CVE-2018-10077, CVE-2018-10078, CVE-2018-10079 Twitter: @bzyo Exploit Title: Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities Date: 04-17-18 Vulnerable Software: WatchDog Console - 3.2.2 Vendor Homepage: http://www.itwatchdogs.com/ Version: 3.2.2 Software Link:...

WordPress Doctor Appointment Booking 1.0.0 SQL Injection / XSS

Exploit Title: Wordpress Doctor Appointment Booking Plugin v1.0.0 - SQL Injection / XSS Date: 2018-01-01 Exploit Author: 8bitsec Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/doctor-appointment-booking-wordpress-plugin/21215314 Version: 1.0.0 Tested on: Kali...