WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities

Multiple Broken Access Control vulnerabilities were discovered by m0ze Patchstack in WordPress Social Share Buttons by Supsystic plugin versions = 2.2.3. Solution Update the WordPress Social Share Buttons by Supsystic plugin to the latest available version at least 2.2.4...

Social Share Buttons < 2.2.4 - Subscriber+ SQLi

The plugin does not properly sanitise and escape some parameters before using them in SQL statements available to any authenticated users, leading to SQL injections...

CVE-2021-36890

Cross-Site Request Forgery CSRF vulnerability in Social Share Buttons by Supsystic plugin = 2.2.2 at WordPress...

WordPress plugin Social Share Buttons 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Social Share Buttons plugin 2.2.2 and earlier versions are vulnerable to cross-site request forgery...

WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Daniel Ruf in the WordPress Social Share Buttons by Supsystic plugin versions = 2.2.3. Solution Update the WordPress Social Share Buttons by Supsystic plugin to the latest available version at least 2.2.4...

CVE-2021-36890

CVE-2021-36890 describes a CSRF vulnerability in the Social Share Buttons by Supsystic WordPress plugin, version

CVE-2021-36890: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Social Share Buttons by Supsystic plugin = 2.2.2 at WordPress...

WordPress Custom Share Buttons with Floating Sidebar plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Custom Share Buttons with Floating Sidebar plugin versions = 4.1. Solution Update the WordPress Custom Share Buttons with Floating Sidebar plugin to the latest available version at least 4.2...

Stored XSS vulnerability in Jenkins button labels

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI. This results in a cross-site scripting vulnerability exploitable by attackers with the ability to control button labels. An example of buttons with a user-controlled label are the buttons of the...

MAL-2022-5434 Malicious code in pp-react-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 000ff8cda66b7a099f0780508fa3aa26f9c586ea54c2ec040c448b46ba5e8a97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pp-react-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 000ff8cda66b7a099f0780508fa3aa26f9c586ea54c2ec040c448b46ba5e8a97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Call Now Buttons plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of the WordPress Call Now Buttons plugin prior ...

CVE-2022-0874

The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0874

The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0874

The CVE applies to the WordPress plugin WP Social Buttons up to version 2.1. The vulnerability stems from insufficient sanitisation/escaping of settings, enabling stored Cross-Site Scripting by high-privilege users (e.g., admin) even when unfiltered_html is disallowed. Publicly documented details...

CVE-2022-0874: Improper Neutralization of Input During Web Page Generation

The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress plugin WP Social Buttons跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WP Social Buttons <= 2.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the Delay Time General Settings or Top Margin Advanced Settings of the...

WordPress WP Social Buttons plugin <= 2.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Niraj Mahajan in WordPress WP Social Buttons plugin versions = 2.1. Solution Deactivate and delete. This plugin has been closed as of March 22, 2022 and is not available for download. This closure is temporary, pending a full review...

GHSA-H2V5-3HPC-85J5 Stored Cross-site Scripting vulnerability in Jenkins Extended Choice Parameter Plugin

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...