CVE-2022-3837

The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3837

The CVE-2022-3837 entry concerns the Uji Countdown WordPress plugin prior to v2.3.1. The vulnerability arises from insufficient sanitisation/escaping of certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (including multisite). Mult...

CVE-2022-3837 Uji Countdown < 2.3.1 - Admin+ Stored XSS

The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3837 Uji Countdown < 2.3.1 - Admin+ Stored XSS

The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress plugin Uji Countdown 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2022-24392 · WordPress · Uji Countdown

Name of the Vulnerable Software and Affected Versions: Uji Countdown WordPress plugin versions prior to 2.3.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in...

WordPress Countdown Widget plugin <= 3.1.9.1 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF leading to Cross-Site Scripting XSS discovered by Rasi Afeef Patchstack Alliance in the WordPress Countdown Widget plugin versions = 3.1.9.1. Solution Update the WordPress WordPress Countdown Widget plugin to the latest available version at least 3.1.9.3...

WordPress Countdown Widget < 3.1.9.3 - Admin+ Stored XSS

The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Uji Countdown <= 2.2 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. In the settings of the plugin add the...

Uji Countdown <= 2.2 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. In the settings of the plugin add the payload ...

WordPress Uji Countdown plugin <= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by zhangyunpei in the WordPress Uji Countdown plugin versions = 2.2. Solution Deactivate and delete. This plugin has been closed as of November 9, 2022 and is not available for download. This closure is temporary, pending a full revie...

Malicious code in countdown-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce504edea8acfb8cd95b91d4f9f21907308aed440794736ed3155857bdaf0d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2212 Malicious code in countdown-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce504edea8acfb8cd95b91d4f9f21907308aed440794736ed3155857bdaf0d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wafer-countdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9309c9e3281bc15051d993c4e37ce716321c5e2d9cf30973a379c6e773c3ebae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7021 Malicious code in wafer-countdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9309c9e3281bc15051d993c4e37ce716321c5e2d9cf30973a379c6e773c3ebae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-36526

A vulnerability classified as problematic was found in Countdown Timer. This vulnerability affects unknown code of the component Macro Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2020-36526

A vulnerability classified as problematic was found in Countdown Timer. This vulnerability affects unknown code of the component Macro Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

Cross site scripting

A vulnerability classified as problematic was found in Countdown Timer. This vulnerability affects unknown code of the component Macro Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

Countdown Timer 跨站脚本漏洞

Countdown Timer is a countdown timer widget for Confluence. A security vulnerability exists in Countdown Timer version 1.7.0, which can be exploited by an attacker to remotely launch a cross-site scripting attack...

CVE-2020-36526

CVE-2020-36526 affects Countdown Timer (widget for Confluence) via the Macro Handler, enabling remote cross-site scripting. Connected sources identify a concrete instance: Countdown Timer version 1.7.0 is vulnerable; exploitation is remote and user interaction is required per the CVE description ...