WooCommerce <= 3.4.5 - Authenticated Stored XSS

The WooCommerce WordPress plugin was affected by an Authenticated Stored XSS security vulnerability...

WordPress Jibu Pro plugin <= 1.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Renos Nikolaou in WordPress Jibu Pro plugin versions = 1.7. Solution 2018.09.01 - we were unable to find a patched version of this plugin. Last time updated seven years ago. We recommend to deactivate and delete it...

Cross site scripting

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...

CVE-2018-11330

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...

CVE-2018-10326

PrinterOn Enterprise 4.1.3 is affected by multiple authenticated stored XSS vulnerabilities: (1) department field in printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest. No remediation or exploit details are p...

CVE-2018-10259

An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user...

Geist WatchDog Console 3.2.2 XSS / XML Injection / Insecure Permissions

Exploit Author: bzyo CVE: CVE-2018-10077, CVE-2018-10078, CVE-2018-10079 Twitter: @bzyo Exploit Title: Geist WatchDog Console 3.2.2 - Multiple Vulnerabilities Date: 04-17-18 Vulnerable Software: WatchDog Console - 3.2.2 Vendor Homepage: http://www.itwatchdogs.com/ Version: 3.2.2 Software Link:...

WordPress Doctor Appointment Booking 1.0.0 SQL Injection / XSS

Exploit Title: Wordpress Doctor Appointment Booking Plugin v1.0.0 - SQL Injection / XSS Date: 2018-01-01 Exploit Author: 8bitsec Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/doctor-appointment-booking-wordpress-plugin/21215314 Version: 1.0.0 Tested on: Kali...

NethServer 7.3.1611 (Upload.json) CSRF Script Insertion Vulnerability

Description NethServer suffers from an authenticated stored XSS vulnerability. Input passed to the 'BackupConfigUploadDescription' POST parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser sessio...

WordPress Training Membership 1.0.8 Cross Site Scripting Vulnerability

WordPress Fitness Trainer - Training Membership plugin versions 1.0.8 and below suffer from a cross site scripting vulnerability. Exploit Title: Wordpress Fitness Trainer - Training Membership Plugin ================== 8bitsec - https://twitter.com/8bitsec 0day.today 2018-04-09...

WordPress Gym Management System 07-05-2017 Code Execution / Cross Site Scripting

Exploit Title: WPGYM - Wordpress Gym Management System Member View Add weight Upload image shell.png.php Save Measurement An alert will warn you about incorrect file type but it will still upload it. Go to Workouts View Measurement Right Click on Image View Image or Copy Image URL Paste on your...

FormCraft - Premium WordPress Form Builder <= v3.2.31 - Authenticated Stored XSS

WordPress FormCraft Premium WordPress Form Builder versions 3.2.31 and below suffer from a persistent Cross-Site Scripting XSS vulnerability. Authenticated Stored XSS: New Form Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed...

LayerSlider <= 6.2.0 - CSRF / Authenticated Stored XSS & SQL Injection

The LayerSlider WordPress plugin was affected by a CSRF / Authenticated Stored XSS & SQL Injection security vulnerability...

rockhoist-badges 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS)

The rockhoist-badges WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

Easy Table <= 1.6 - Authenticated Stored Cross-Site Scripting (XSS)

The Easy Table WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

OLX: Multiple vulnerabilities in http://blog.dubizzle.com/uae

http://blog.dubizzle.com/uae/ uses outdated Yoast Seo plugin which has following vulnerabilities: ! Title: Yoast SEO = 3.2.4 - Subscriber Settings Sensitive Data Exposure Reference: https://wpvulndb.com/vulnerabilities/8487 ! Title: Yoast SEO = 3.2.5 - Unspecified Cross-Site Scripting XSS...

WP Canvas - Shortcodes <= 2.05 - Authenticated Stored Cross-Site Scripting (XSS)

The Shortcodes by Angie Makes WordPress plugin was affected by a Shortcodes = 2.05 - Authenticated Stored Cross-Site Scripting XSS security vulnerability...

WP Google Maps <= 6.3.14 - Authenticated Stored Cross-Site Scripting (XSS) via CSRF

The WP Google Maps WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS via CSRF security vulnerability...

InPost Gallery <= 2.1.2 - LFI & Authenticated Stored XSS

The InPost Gallery WordPress plugin was affected by a LFI & Authenticated Stored XSS security vulnerability...

Vicidial 2.11 - Scripts Persistent Cross-Site Scripting

Exploit for php platform in category web applications Exploit Title: Vicidial 2.11 Scripts - Authenticated Stored XSS Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Vendor Homepage: http://vicidial.org Software Link:...