Booster Elite for WooCommerce < 7.1.3 - Subscriber+ Content Injection

Description The Booster Elite for WooCommerce plugin for WordPress is vulnerable to content injection via an unknown parameter in all versions up to and including 7.1.2 due to insufficient capability checks. This makes it possible for authenticated attackers, with subscriber access and above, to...

GitLab 14.9 < 15.1.6 / 15.2 < 15.2.4 / 15.3 < 15.3.2 (CVE-2022-2527)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15...

WordPress Booster Elite for WooCommerce Plugin < 7.1.3 is vulnerable to Content Injection

Software Booster Elite for WooCommerce Type Plugin Vulnerable versions 7.1.3 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2023-51511 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1e2bd30a7dcc Credits Dave Jong...

Getwid < 2.0.3 - Unauthenticated Arbitrary Email Sending to Admin

Description Any unauthenticated user may send e-mail from the site with any title or content to the admin PoC fetch"http://127.0.0.1:8001/wp-admin/admin-ajax.php?action=getwidsendmail", "headers": "content-type": "application/x-www-form-urlencoded", , "body": "datasubject=Urgent WordPress update...

Archer Platform Security Vulnerability

Archer Platform is a modern integrated risk management solution from Archer, Inc. A security vulnerability exists in Archer Platform version 6.x prior to 6.13 P2 6.13.0.2 that stems from the presence of an HTML content injection vulnerability...

CVE-2023-48642

Archer Platform 6.x before 6.13 P2 6.13.0.2 contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through...

CVE-2023-48642

CVE-2023-48642 affects Archer Platform 6.x up to 6.13 P2 (6.13.0.2). The issue is an authenticated HTML content injection vulnerability in the data store; a remote authenticated Archer user can store malicious HTML code in a trusted application data store, with victim users’ browsers executing it...

JetFormBuilder < 3.1.5 - Unauthenticated Content Injection

Description The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to content injection in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to inject content onto the site...

WordPress Responsive Slick Slider WordPress Plugin <= 1.4 is vulnerable to Content Injection

Software Responsive Slick Slider WordPress Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-49852 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6149e117fdc9 Credits Abdi Pranata Required privilege...

wpForo Forum < 2.2.6 - Subscriber+ Content Injection

Description The plugin does not properly escape user input, allowing any authenticated users, such as Subscriber to inject content...

WordPress JetFormBuilder Plugin <= 3.1.4 is vulnerable to Content Injection

Software JetFormBuilder Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.1.5 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2023-48763 Patch priority Low CVSS severity Low 5.3 Developer Crocoblock PSID fd2d4da6e79b Credits Revan Arifio Required privilege Unauthenticated...

WordPress Booster for WooCommerce Plugin <= 7.1.2 is vulnerable to Content Injection

Software Booster for WooCommerce Type Plugin Vulnerable versions = 7.1.2 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2023-48747 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID f10b42acb401 Credits Dave Jong Patchstac...

ARI Stream Quiz <= 1.3.1 - Contributor+ Content Injection

Description The plugin is vulnerable to content injection due to improper capability checks on the quiz editing functionality in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with contributor access and above, to publish quizzes containing arbitrary...

Responsive Tabs < 4.0.6 - Authenticated (Contributor+) Content Injection

Description The Responsive Tabs plugin for WordPress is vulnerable to Arbitrary Content Injection in versions prior to 4.0.6. This vulnerability makes it possible for authenticated attackers, with contributor-level permissions and above, to inject new content onto the website, possibly through th...

WordPress Stripe Payments Plugin <= 2.0.79 is vulnerable to Content Injection

Software Stripe Payments Type Plugin Vulnerable versions = 2.0.79 Fixed in 2.0.80 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2023-48285 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d526738c5887 Credits Joshua Chan Required privilege...

WP Content Pilot – Autoblogging & Affiliate Marketing Plugin < 1.3.4 - Authenticated (Contributor+) Content Injection

Description The WP Content Pilot plugin for WordPress is vulnerable to Arbitrary Content Injection in versions up to, and including, 1.3.3. This vulnerability makes it possible for authenticated attackers, with contributor access or higher to inject new content onto the website, possibly through...

Foyer <= 1.7.5 - Content Injection via Improper Access Control

Description The Foyer – Digital Signage for WordPress plugin for WordPress is vulnerable to unauthorized content injection due to an insufficient capability check on the editing functionality in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with...

WordPress wpForo Forum Plugin <= 2.2.5 is vulnerable to Content Injection

Software wpForo Forum Type Plugin Vulnerable versions = 2.2.5 Fixed in 2.2.6 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2023-47869 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e9607ec97842 Credits Jesse McNeil Required privilege...

WordPress Foyer Plugin <= 1.7.5 is vulnerable to Content Injection

Software Foyer Type Plugin Vulnerable versions = 1.7.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Content Injection CVE CVE-2023-47663 Patch priority Low CVSS severity Low 4.6 Developer Claim ownership PSID 8b7640063c90 Credits Abdi Pranata Required privilege Contributor...

wpDiscuz < 7.6.11 - Unauthenticated Content Injection

Description The plugin is vulnerable to Arbitrary Content Injection, making it possible for unauthenticated attackers to inject new content onto the website, possibly through the manipulation of posts to create new web pages, spam, or phishing...