CVE-2024-2536: Improper Input Validation

The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HowTo block attributes in all versions up to, and including, 1.0.214 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-20901

Name of the Vulnerable Software and Affected Versions Rank Math SEO with AI SEO Tools plugin for WordPress versions up to, and including, 1.0.214 Description The issue is related to Stored Cross-Site Scripting via the HowTo block attributes due to insufficient input sanitization and output escapi...

CVE-2023-3279

The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks...

PT-2023-24023 · WordPress · Wordpress Gallery Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Gallery Plugin version prior to 3.39 Description: The issue allows Admin users to perform Local File Inclusion LFI attacks due to the plugin's failure to validate certain block attributes before using them to generate paths passed t...

CVE-2023-3279: Undefined Security Weakness

The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks...

WordPress 4.7.x < 4.7.26 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A directory traversal via wplang. CVE-2023-2745 - A Cross-Site Request Forgery CSRF via wpajaxsetattachmentthumbnail. - An authenticated stored Cross-Site Scripting XSS vi...

Cross-site Scripting (XSS)

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient sanitization of block attributes. An attacker can embed arbitrary content in HTML comments on the page by...

CVE-2022-4570

The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users suc...

CVE-2022-4570: Undefined Security Weakness

The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users suc...

CVE-2021-24759: Improper Neutralization of Input During Web Page Generation

The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks...