CVE-2024-11841

The Tithe.ly Giving Button WordPress plugin (versions through 1.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly validate and escape certain shortcode attributes before they are output back onto a page or post. This flaw allows users with contributo...

WordPress plugin CRUDLab Google Plus Button 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2024-36286 · Crudlab · Crudlab Google Plus Button

Name of the Vulnerable Software and Affected Versions: CRUDLab Google Plus Button versions 1.0.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the CRUDLab Google Plus Button. This means an attacker can perform unauthoriz...

WordPress plugin Tithe.ly Giving Button 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-17289 · WordPress · Tithe.Ly Giving Button

Name of the Vulnerable Software and Affected Versions: Tithe.ly Giving Button WordPress plugin versions 1.1 and earlier Description: The issue concerns a Stored Cross-Site Scripting vulnerability. It arises because the plugin does not validate and escape some of its shortcode attributes before...

CVE-2024-54399: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in CRUDLab CRUDLab Google Plus Button crudlab-google-plus allows Stored XSS.This issue affects CRUDLab Google Plus Button: from n/a through = 1.0.2...

CVE-2024-55982: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in richteam Share Buttons – Social Media rich-web-share-button allows Blind SQL Injection.This issue affects Share Buttons – Social Media: from n/a through = 1.0.2...

CVE-2024-11841: Improper Neutralization of Input During Web Page Generation

The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2024-17323

Name of the Vulnerable Software and Affected Versions IDer Login for WordPress plugin versions up to, and including, 2.1 Description The IDer Login for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the plugin's 'ider login button' shortcode due to insufficient input sanitizati...

WordPress plugin Smart PopUp Blaster 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2024-17601 · WordPress · Smart Popup Blaster

Name of the Vulnerable Software and Affected Versions: Smart PopUp Blaster plugin for WordPress versions up to, and including, 1.4.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode due to insufficient input sanitization and output escaping ...

CVE-2024-12458: Improper Neutralization of Input During Web Page Generation

The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-34376

Missing Authorization vulnerability in Sekander Badsha Change WooCommerce Add To Cart Button Text change-woocommerce-add-to-cart-button-text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through = 1....

PT-2024-12476 · WordPress · Change Woocommerce Add To Cart Button Text

Name of the Vulnerable Software and Affected Versions: Change WooCommerce Add To Cart Button Text versions 1.3 and earlier Description: The issue affects the Change WooCommerce Add To Cart Button Text plugin, allowing exploitation of incorrectly configured access control security levels due to a...

CVE-2023-34376: Missing Authorization

Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through 1.3...

WordPress CRUDLab Google Plus Button plugin <= 1.0.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin CRUDLab Google Plus Button versions = 1.0.2...

DRUPAL-CONTRIB-2024-072

This module provides a block that renders a link providing the functionality of a browser's back button. The module does not sufficiently escape text entered by an administrator, resulting in a cross scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a...

Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

This module provides a block that renders a link providing the functionality of a browser's back button. The module does not sufficiently escape text entered by an administrator, resulting in a cross scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a...

Drupal Browser Back Button module 1.0.0-2.0.1 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Patrick Fey in WordPress Module Browser Back Button versions 1.0.0-2.0.1...

CVE-2023-49154

Missing Authorization vulnerability in Wow-Company Button Generator – easily Button Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8...