NethServer 7.3.1611 (Upload.json) CSRF Script Insertion Vulnerability

Description NethServer suffers from an authenticated stored XSS vulnerability. Input passed to the 'BackupConfigUploadDescription' POST parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser sessio...

WordPress Training Membership 1.0.8 Cross Site Scripting Vulnerability

WordPress Fitness Trainer - Training Membership plugin versions 1.0.8 and below suffer from a cross site scripting vulnerability. Exploit Title: Wordpress Fitness Trainer - Training Membership Plugin ================== 8bitsec - https://twitter.com/8bitsec 0day.today 2018-04-09...

WordPress Gym Management System 07-05-2017 Code Execution / Cross Site Scripting

Exploit Title: WPGYM - Wordpress Gym Management System Member View Add weight Upload image shell.png.php Save Measurement An alert will warn you about incorrect file type but it will still upload it. Go to Workouts View Measurement Right Click on Image View Image or Copy Image URL Paste on your...

FormCraft - Premium WordPress Form Builder <= v3.2.31 - Authenticated Stored XSS

WordPress FormCraft Premium WordPress Form Builder versions 3.2.31 and below suffer from a persistent Cross-Site Scripting XSS vulnerability. Authenticated Stored XSS: New Form Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed...

LayerSlider <= 6.2.0 - CSRF / Authenticated Stored XSS & SQL Injection

The LayerSlider WordPress plugin was affected by a CSRF / Authenticated Stored XSS & SQL Injection security vulnerability...

rockhoist-badges 1.2.2 - Authenticated Stored Cross-Site Scripting (XSS)

The rockhoist-badges WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

Easy Table <= 1.6 - Authenticated Stored Cross-Site Scripting (XSS)

The Easy Table WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

OLX: Multiple vulnerabilities in http://blog.dubizzle.com/uae

http://blog.dubizzle.com/uae/ uses outdated Yoast Seo plugin which has following vulnerabilities: ! Title: Yoast SEO = 3.2.4 - Subscriber Settings Sensitive Data Exposure Reference: https://wpvulndb.com/vulnerabilities/8487 ! Title: Yoast SEO = 3.2.5 - Unspecified Cross-Site Scripting XSS...

WP Canvas - Shortcodes <= 2.05 - Authenticated Stored Cross-Site Scripting (XSS)

The Shortcodes by Angie Makes WordPress plugin was affected by a Shortcodes = 2.05 - Authenticated Stored Cross-Site Scripting XSS security vulnerability...

WP Google Maps <= 6.3.14 - Authenticated Stored Cross-Site Scripting (XSS) via CSRF

The WP Google Maps WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS via CSRF security vulnerability...

InPost Gallery <= 2.1.2 - LFI & Authenticated Stored XSS

The InPost Gallery WordPress plugin was affected by a LFI & Authenticated Stored XSS security vulnerability...

Vicidial 2.11 - Scripts Persistent Cross-Site Scripting

Exploit for php platform in category web applications Exploit Title: Vicidial 2.11 Scripts - Authenticated Stored XSS Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Vendor Homepage: http://vicidial.org Software Link:...

Vicidial 2.11 Cross Site Scripting

Exploit Title: Vicidial 2.11 Scripts - Authenticated Stored XSS Date: 0 day Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Vendor Homepage: http://vicidial.org Software Link: https://sourceforge.net/projects/astguiclient/files/astguiclient2.11rc1.zip/download...

WordPress Content text slider on post plugin <= 6.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by ALIREZAPROMIS in WordPress Content text slider on post plugin versions = 6.8. Solution Update the WordPress Content text slider on post plugin to the latest available version at least 6.9...

Testimonial Slider <= 1.2.1 - Authenticated Stored Cross-Site Scripting (XSS) & CSRF

This vulnerability needs administrator privileges to exploit. Editor and author roles do not have the necessary permissions to create new sliders, contrary to what the original advisory says. However, this vulnerability can be exploited by a malicious actor by combining the XSS with CSRF to...

Admin Pack by SITE CASEIRO <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The admin-pack-by-site-caseiro WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

WordPress Download Manager Free 2.7.94 / Pro 4 XSS

WordPress Download Manager Free 2.7.94 & Pro 4 Authenticated Stored XSS Vendor Homepage: http://www.wpdownloadmanager.com Software Link: https://wordpress.org/plugins/download-manager Affected Versions: Free 2.7.94 & Pro 4 Tested on: WordPress 4.2.2 Discovered by Filippos Mastrogiannis Twitter:...

WordPress Download Manager Free 2.7.94 & Pro 4 - Authenticated Stored XSS

Download Manager Free and Pro is prone to an authenticated stored XSS that allows an attacker to create new download package and upload files, called .jpg. This vulnerability works, when user try to edit this download package. Solution Upgrade to the latest version...

Plotly <= 1.0.2 - Authenticated Stored Cross-Site Scripting (XSS)

The Plotly WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS security vulnerability...

Yoast SEO <= 2.1.1 - Authenticated Stored DOM XSS

The "snippet preview" functionality of the Yoast WordPress SEO plugin was susceptible to cross-site scripting in versions before 2.2. Vulnerable URL: /wp-admin/post-new.php?posttitle= Vulnerable Code wordpress-seo/js/wp-seo-metabox.js: function ystcleanstr if str == '' || str == undefined return...