5291 matches found
CVE-2023-0583 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updatevkblocksoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons...
CVE-2023-0583 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updatevkblocksoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons...
WordPress plugin VK Blocks 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
PT-2023-16382 · WordPress · Vk Blocks
Name of the Vulnerable Software and Affected Versions: VK Blocks plugin for WordPress versions up to, and including, 1.57.0.5 Description: The issue concerns improper authorization via the REST update vk blocks options function. This allows authenticated attackers with contributor-level permissio...
PT-2023-16383 · WordPress · Vk Blocks
Name of the Vulnerable Software and Affected Versions: VK Blocks plugin for WordPress versions up to, and including, 1.57.0.5 Description: The issue concerns improper authorization via the REST update options function. This allows authenticated attackers with contributor-level permissions or abov...
WordPress plugin VK Blocks 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
VK Blocks < 1.57.1.0 - Contributor+ Settings Update via REST API
The plugin uses improper authorization for the REST API vk-blocks/v1/updatevkblocksoptions, allowing users with a role as low as contributor to change plugin settings including default icons...
VK Blocks < 1.58.0.0 - Contributor+ Settings Update via REST API
The plugin uses improper authorization for the REST API vk-blocks/v1/options/vkfontawesomeversion, allowing users with a role as low as contributor to change the vkfontawesomeversion option to an arbitrary value...
CVE-2023-33964 mx-chain-go does not treat invalid transaction with wrong username correctly
mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor...
DRUPAL-CONTRIB-2023-019
This module provides social media share & follow buttons. The module doesn't sufficiently restrict AddToAny block settings to users who have permission to administer AddToAny. This allows users with lower permission to configure malicious code leading to a Cross Site Scripting XSS vulnerability...
DRUPAL-CONTRIB-2023-016
The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting XSS vulnerability. Th...
Consent Popup - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-017
The Consent Popup provides a configurable popup that requires acceptance of a question before the visitor can continue, typically used for age consent. The module doesn't sufficiently sanitizes the text on the block leading to a cross site scripting XSS vulnerability. This vulnerability is...
Iubenda Integration - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-016
The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting XSS vulnerability. Th...
CVE-2023-33212
Cross-Site Request Forgery CSRF vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin = 3.0.6 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin = 3.0.6 versions...
CVE-2023-33212
CVE-2023-33212 : Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin with version <= 3.0.6 contains a CSRF vulnerability (unauthenticated). The issue is mitigated by upgrading to version 3.0.7 or later. Multiple sources confirm the vulnerability details and patch, e.g., PatchStack n...
PT-2023-24223 · Crocoblock · Crocoblock Jetformbuilder
Name of the Vulnerable Software and Affected Versions: Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin versions 3.0.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into...
WordPress plugin JetFormBuilder — Dynamic Blocks Form Builder 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
CVE-2023-27925
Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script...
CVE-2023-27923
Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script...