1025 matches found
CVE-2024-3494
The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...
WordPress Mesmerize Companion plugin <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via mesmerizecontactform Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Mesmerize Companion versions = 1.6.148...
WordPress Mesmerize Companion Plugin <= 1.6.148 is vulnerable to Cross Site Scripting (XSS)
Software Mesmerize Companion Type Plugin Vulnerable versions = 1.6.148 Fixed in 1.6.149 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3494 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a79965937956 Credits stealthcopter...
PT-2024-26260 · WordPress · Mesmerize Companion
Name of the Vulnerable Software and Affected Versions: Mesmerize Companion plugin for WordPress versions up to, and including, 1.6.148 Description: The issue is related to Stored Cross-Site Scripting via the plugin's mesmerize contact form shortcode due to insufficient input sanitization and outp...
WordPress plugin Mesmerize Companion 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...
CVE-2024-0022
In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction...
CVE-2024-0022
In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that stems from improper input validation in multiple methods of the CompanionDeviceManagerService.java file, which can be exploited by an attacker to launch anothe...
CPO Companion <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to injec...
Mesmerize Companion < 1.6.149 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode
Description The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...
PT-2024-15299 · Unknown · Companiondevicemanagerservice
Name of the Vulnerable Software and Affected Versions: CompanionDeviceManagerService.java affected versions not specified Description: The issue is related to improper input validation in multiple functions of CompanionDeviceManagerService.java. This could lead to the launch of...
CVE-2024-33916
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0...
CVE-2024-33916 WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0...
CVE-2024-33916
CVE-2024-33916 affects MachoThemes CPO Companion for WordPress (CPO Companion plugin) with Stored XSS via input during web page generation. Root cause: improper neutralization of input. Affected range: from n/a through 1.1.0. Publicly available details from RH and Wordfence confirm the vulnerabil...
CVE-2024-33916 WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0...
WordPress plugin CPO Companion 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site...
WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin CPO Companion versions = 1.1.0...
WordPress CPO Companion Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)
Software CPO Companion Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33916 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 57daf6c77a1b Credits Ngô Thiên An ancorn from VNPT-VCI Required...
Blocksy Companion < 2.0.29 - Cross-Site Request Forgery
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performi...