290 matches found
CVE-2024-24871
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Creative Themes Blocksy allows Stored XSS.This issue affects Blocksy: from n/a through 2.0.19...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Creative Themes Blocksy allows Stored XSS.This issue affects Blocksy: from n/a through 2.0.19...
CVE-2024-24871 WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through = 2.0.19...
CVE-2024-24871
CVE-2024-24871 affects the WordPress Blocksy Theme up to version 2.0.19. The issue is a Stored XSS caused by improper neutralization of input during web page generation. Impact is described as low severity (CVSS ~6.5) with network attack vector, low attack complexity, privileges required: LOW, an...
CVE-2024-24871 WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through = 2.0.19...
WordPress Plugin Blocksy Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...
PT-2024-20627 · Blocksy · Blocksy
Name of the Vulnerable Software and Affected Versions: Blocksy versions through 2.0.19 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...
WordPress Blocksy Theme <= 2.0.19 is vulnerable to Cross Site Scripting (XSS)
Software Blocksy Type Theme Vulnerable versions = 2.0.19 Fixed in 2.0.20 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24871 Patch priority Low CVSS severity Low 6.5 Developer Creative Themes PSID 07c604dd56fb Credits savphill Required privilege Editor Published ...
WordPress Blocksy Companion Plugin <= 1.8.46 is vulnerable to Cross Site Scripting (XSS)
Software Blocksy Companion Type Plugin Vulnerable versions = 1.8.46 Fixed in 1.8.47 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Creative Themes PSID ec10715e354a Credits Rafie Muhammad Patchstack Requir...
CVE-2023-1911
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example...
CVE-2023-1911
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example...
Design/Logic Flaw
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example...
CVE-2023-1911 Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example...
CVE-2023-1911
Blocksy Companion (WordPress plugin by Creative Themes) before 1.8.82 contains an authorization flaw: posts accessible via a shortcode are not confirmed public, allowing any authenticated user (e.g., subscribers) to view draft content. This exposes draft posts to users who should not have access....
CVE-2023-1911 Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example...
WordPress plugin Blocksy Companion 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2023-17333 · WordPress · Blocksy Companion
Name of the Vulnerable Software and Affected Versions: Blocksy Companion WordPress plugin versions prior to 1.8.82 Description: The issue allows any authenticated users, such as subscribers, to access draft posts via a shortcode, because it does not ensure that posts are already public and can be...
WordPress Blocksy Companion Plugin < 1.8.82 is vulnerable to Sensitive Data Exposure
Software Blocksy Companion Type Plugin Vulnerable versions 1.8.82 Fixed in 1.8.82 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-1911 Patch priority Medium CVSS severity Medium 4.3 Developer Creative Themes PSID a9848e95cc61 Credits Erwan LR WPScan...
Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access
The plugin does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example Run the below command in the developer console of the web browser while being on the blog as a subscrib...