WordPress Simple Buttons Creator Plugin <= 1.04 is vulnerable to Cross Site Scripting (XSS)

Software Simple Buttons Creator Type Plugin Vulnerable versions = 1.04 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2857 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f8f6e6e1aab1 Credits Bob Matyas...

CVE-2024-2858: Cross-Site Request Forgery (CSRF)

The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-2857: Cross-Site Request Forgery (CSRF)

The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them...

WordPress Simple Buttons Creator Plugin <= 1.04 is vulnerable to Cross Site Request Forgery (CSRF)

Software Simple Buttons Creator Type Plugin Vulnerable versions = 1.04 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2858 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bfe6a65231af Credits Bob Matyas...

WordPress Plugin Simple Buttons Creator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Plugin Simple Buttons Creator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-22483 · WordPress · The Simple Buttons Creator

Name of the Vulnerable Software and Affected Versions: Simple Buttons Creator WordPress plugin versions 1.04 and earlier Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks...

Ross Anderson

Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge. I cant remember when I first met Ross. Of course it was before 2008, when we created the Security and Human Behavior workshop. It was well before 2001, when we created the Workshop on Economics and...

Simple Buttons Creator <= 1.04 - Aribtrary Button Deletion via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Make a logged in admin open a page with the code below where is an existing button:...

GHSA-XGJ4-2HRF-J4XG Cross-site scripting in Survey Creator

Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...

Cross-site scripting in Survey Creator

Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...

CVE-2024-28635

Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...

CVE-2024-28635

Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...

Survey Creator Library 跨站脚本漏洞

Survey Creator Library is SurveyJS open source a GUI-based no-code form generator library . A cross-site scripting vulnerability exists in Survey Creator Library v.1.9.132 and earlier versions that could allow an attacker to execute arbitrary code and obtain sensitive information via the title...

CVE-2024-28635: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...

CVE-2024-28635

SurveyJS Survey Creator versions v.1.9.132 and before are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper handling of the title parameter within the string-editor.ts file, which allows attackers to execute arbitrary code and obtain sensitive information . ...

CVE-2024-28635

Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...

CVE-2024-28635

Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...

SurveyJS Survey Creator 1.9.132 Cross Site Scripting

Details: Cross Site Scripting vulnerability in Survey JS Survey Creator v.1.9.132 and before allows an attacker to execute arbitrary code via the input field parameters of the creator survey section. ------------------------------------------ Vulnerability Type Cross Site Scripting XSS...

BIT-DISCOURSE-2021-32788 Post creator of a whisper post can be revealed to non-staff users in Discourse

Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal...