CVE-2023-23941

SwagPayPal (Shopware) vulnerable to a mismatch between the amount/item list sent to PayPal and the actual created order when using JavaScript-based PayPal checkout methods (PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, credit card). Root cause: inconsistent data sent to PayPal durin...

CVE-2023-23941 SwagPayPal payment not sent to PayPal correctly

SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used PayPal Plus, Smart Payment Buttons, SEPA, Pay Later, Venmo, Credit card, the amount and item list sent to PayPal may not be identical to the one in the created order. The problem has bee...

Malicious code in ent-cas-form-navigation-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b76254963f588f5a71a7483ecb0f970c5db705214cb7a836d484b8d7ec0b2b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Simple Membership < 4.2.2 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. 1. Exploit...

CVE-2022-3838

The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3838

The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3838

The CVE-2022-3838 entry concerns the WPUpper Share Buttons WordPress plugin (versions

PT-2022-24397 · WordPress · Wpupper Share Buttons

Name of the Vulnerable Software and Affected Versions: WPUpper Share Buttons WordPress plugin versions 3.42 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

WordPress plugin WPUpper Share Buttons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress WPUpper Share Buttons plugin <= 3.42 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by zhangyunpei in WordPress WPUpper Share Buttons plugin versions = 3.42. Solution Deactivate and delete. This plugin has been closed as of November 9, 2022 and is not available for download. This closure is temporary, pending a full...

CVE-2021-36839

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Social Media Follow Buttons Bar plugin = 4.73 at WordPress...

CVE-2021-36839

CVE-2021-36839 affects the WordPress plugin “Social Media Follow Buttons Bar” (versions

CVE-2021-36839 WordPress Social Media Follow Buttons Bar plugin <= 4.73 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Social Media Follow Buttons Bar plugin = 4.73 at WordPress...

PT-2022-10571 · WordPress · Social Media Follow Buttons Bar

Name of the Vulnerable Software and Affected Versions: Social Media Follow Buttons Bar plugin versions prior to 4.74 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by an admin or higher-privileged user. The...

Social Media Follow Buttons Bar <= 4.73 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Social Share Buttons 2.2.3 SQL injection Vulnerability

Title: Social Share Buttons-2.2.3 SQLi Author: nu11secur1ty Vendor: https://wordpress.org/ Software: https://downloads.wordpress.org/plugin/social-share-buttons-by-supsystic.2.2.3.zip Reference:...

Social Share Button 2.2.3 SQL Injection

Title: Social Share Buttons-2.2.3 SQLi Author: nu11secur1ty Date: 09.16.2022 Vendor: https://wordpress.org/ Software: https://downloads.wordpress.org/plugin/social-share-buttons-by-supsystic.2.2.3.zip Reference:...

WordPress Social Share Buttons SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Social Share Buttons 2.2.3 and prior versions, which stems from the application's lack of...

WordPress Social Share Buttons Access Control Error Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. An access control error vulnerability exists in WordPress Social Share Buttons 2.2.3 and prior versions, which stems from an improper access contr...

CVE-2022-0594

The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated in v 9.7.5 and author+ in v9.7.5 users, allowing them to call it and retrieve various information such as t...