Cross site scripting

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

CVE-2021-25023 Speed Booster Pack < 4.3.3.1 - Admin+ SQL Injection

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbpconverttablename parameter before using it in a SQL statement to convert the related table, leading to an SQL injection...

CVE-2021-25023

The CVE-2021-25023 entry documents an SQL injection in the WordPress plugin Speed Booster Pack (Admin+ SQL Injection) prior to 4.3.3.1. The root cause is failure to escape the sbp_convert_table_name parameter before using it in a SQL statement used to convert a related table. Impact stated includ...

CVE-2021-25001

CVE-2021-25001 affects the WordPress Booster for WooCommerce plugin (versions before 5.4.9). Multiple connected sources confirm a vulnerability in the Product XML Feeds module: the wcj_create_products_xml_result parameter is not sanitised/escaped when output in the admin dashboard, enabling a ref...

CVE-2021-25001 Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjcreateproductsxmlresult parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24999

CVE-2021-24999 concerns the Booster for WooCommerce WordPress plugin, up to version 5.4.8. The vulnerability is a reflected Cross-Site Scripting in the Pdf Invoicing module, where the wcj_notice parameter is not properly sanitised/escaped before being output in the admin dashboard. Affected compo...

CVE-2021-24999 Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

PT-2022-9557

Name of the Vulnerable Software and Affected Versions The Booster for WooCommerce WordPress plugin versions prior to 5.4.9 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the wcj delete role parameter is not properly sanitised and escaped before bei...

CVE-2021-25023: Improper Neutralization of Special Elements used in an SQL Command

The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.3.3.1 does not escape the sbpconverttablename parameter before using it in a SQL statement to convert the related table, leading to an SQL injection...

PT-2022-9580

Name of the Vulnerable Software and Affected Versions Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin versions prior to 4.3.3.1 Description The issue concerns an SQL injection due to the sbp convert table name parameter not being properly escaped before use in a SQL statement...

WordPress plugin Speed Booster Pack âš¡ PageSpeed Optimization Suite SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blogging sites on servers with PHP and MySQL.The WordPress plugin Speed Booster Pack version 4.3.3.1 previously had a SQL injection...

PT-2022-9556

Name of the Vulnerable Software and Affected Versions The Booster for WooCommerce WordPress plugin versions prior to 5.4.9 Description The issue arises from the lack of sanitization and escaping of the wcj notice parameter in the admin dashboard when the Pdf Invoicing module is enabled, leading t...

CVE-2021-24999: Improper Neutralization of Input During Web Page Generation

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

CVE-2021-25000: Improper Neutralization of Input During Web Page Generation

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjdeleterole parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue...

PT-2022-9558

Name of the Vulnerable Software and Affected Versions The Booster for WooCommerce WordPress plugin versions prior to 5.4.9 Description The issue arises from the lack of sanitization and escaping of the wcj create products xml result parameter in the admin dashboard when the Product XML Feeds modu...

WordPress plugin 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Booster for WooCommerce, which stems from the program's failure to filter and...

WordPress plugin 跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. A cross-site scripting vulnerability exists in versions of the WordPress Booster for WooCommerce plugin prior to 5.4.9. createproductsxmlresult parameter is escaped and filtered, an attacker can...

CVE-2021-25001: Improper Neutralization of Input During Web Page Generation

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjcreateproductsxmlresult parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24747

The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fnmyajaxifieddataloaderajax" AJAX request as the $REQUEST'order'0'dir' parameter is not properly escaped leading to blind and error-based SQL injections...

CVE-2021-24747

The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fnmyajaxifieddataloaderajax" AJAX request as the $REQUEST'order'0'dir' parameter is not properly escaped leading to blind and error-based SQL injections...