Cross site scripting

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, and including, 1.63.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5706

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, and including, 1.63.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress WooCommerce Blocks Plugin <= 11.1.1 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Blocks Type Plugin Vulnerable versions = 11.1.1 Fixed in 11.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47777 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 99320ddb7175 Credits Rafie Muhammad Patchstack Require...

CVE-2023-5745

The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-41732

Cross-Site Request Forgery CSRF vulnerability in CodePeople CP Blocks plugin = 1.0.20 versions...

CVE-2023-41732 WordPress CP Blocks Plugin <= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in CodePeople CP Blocks plugin = 1.0.20 versions...

CVE-2023-41732 WordPress CP Blocks Plugin <= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in CodePeople CP Blocks plugin = 1.0.20 versions...

CVE-2023-44262

CVE-2023-44262 affects the WordPress Blocks plugin up to version 1.6.41. The vulnerability is an Auth. (admin+) Stored Cross-Site Scripting (XSS) caused by insufficient input validation/escaping of parameters, allowing stored XSS for authenticated administrators. Public exploitation details are n...

CVE-2023-44262 WordPress Blocks Plugin <= 1.6.41 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Renzo Johnson Blocks plugin = 1.6.41 versions...

WordPress Blocks Plugin <= 1.6.42 is vulnerable to Cross Site Scripting (XSS)

Software Blocks Type Plugin Vulnerable versions = 1.6.42 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-44262 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 02f792d40bcd Credits Rio Darmawan Required privilege...

CVE-2023-36385

Unauth. Reflected Cross-Site Scripting XSS vulnerability in wpxpo PostX – Gutenberg Post Grid Blocks plugin = 2.9.9 versions...

WordPress Spice Blocks Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Spice Blocks Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID eed12859a044 Credits Rafie Muhammad Patchstack Required...

WordPress One Page Blocks Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software One Page Blocks Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 260976c0490e Credits Rafie Muhammad Patchstack Required...

WordPress Extreme Blocks Plugin <= 0.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Extreme Blocks Type Plugin Vulnerable versions = 0.8.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 084f10a70314 Credits Rafie Muhammad Patchstack Required...

CVE-2023-35047 WordPress All Bootstrap Blocks Plugin <= 1.3.6 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in AREOI All Bootstrap Blocks plugin = 1.3.6 versions...

CVE-2023-2087

The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change plugin settings via a forged...

CVE-2023-2084

The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the get function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin settings. While a nonce check is...

Design/Logic Flaw

The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to save plugin settings. While a nonce check is presen...

Cross site request forgery (csrf)

The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change plugin settings via a forged...

CVE-2023-2087 Essential Blocks <= 4.0.6 - Cross-Site Request Forgery via save

The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change plugin settings via a forged...