WordPress 插件 跨站请求伪造漏洞

WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin admin-custom-login, which stems from the fact that the Admin Custom Login WordPress plugin is susceptible to cross-site request forgery attacks due to the loginbgSave found...

Admin Custom Login < 3.2.8 - CSRF to Stored XSS

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the /includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7. PoC...

WordPress Custom Login Redirect plugin <= 1.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored XSS

Cross-Site Request Forgery CSRF vulnerability leading to Stored XSS discovered by Vinay Bhuria in WordPress Custom Login Redirect plugin versions = 1.0.0. Solution This plugin has been closed as of June 14, 2021 and is not available for download. This closure is temporary, pending a full review...

Custom Login Redirect <= 1.0.0 - CSRF to Stored XSS

The plugin does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue alert/XSS/' /...

Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them even when the unfiletedhtml is disabled Use a payload such as a" in the plugin settings for example, the Powered by Text input...

Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them even when the unfiletedhtml is disabled PoC Use a payload such as a" in the plugin settings for example, the Powered by Text input...

WordPress erident-custom-login-and-dashboard plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress erident-custom-login-and-dashboard plugin...

CVE-2015-9322

The CVE concerns the WordPress plugin erident-custom-login-and-dashboard (before version 3.5), where CSRF is reported. Multiple connected sources corroborate CSRF as the underlying issue (CVE entry, Red Hat advisory, CNVD, CVE List, CVE record). The NVD details show CVSS scores: CVSS v2 base 6.8 ...

WordPress Admin Custom Login 2.4.5.2 Cross Site Scripting

------------------------------------------------------------------------ Admin Custom Login WordPress plugin affected by persistent Cross-Site Scripting via Logo URL field ------------------------------------------------------------------------ Burak Kelebek, July 2016...

WordPress Erident Custom and Dashboard Plugin Cross-Site Scripting Vulnerabilities

WordPress is a blogging platform developed in PHP, which supports personal blog sites on PHP and MySQL servers.Erident Custom Login is a plugin to customize the login screen of the WordPress console.The WordPress Dashboard is the first page you see after logging in to the backend. The first page...

Erident Custom Login & Dashboard 3.4-3.4.1 - Stored Cross-Site Scripting (XSS)

The Erident Custom Login and Dashboard plugin exposes a call to the updateoption method, when a specific POST field is posted to the plugins setting screen. No CSRF token is used, and as such if an Administrative user can be tricked into visiting a site with a malicious form, it is possible to...

Erident Custom Login & Dashboard 3.4-3.4.1 - Stored Cross-Site Scripting (XSS)

The Erident Custom Login and Dashboard plugin exposes a call to the updateoption method, when a specific POST field is posted to the plugins setting screen. No CSRF token is used, and as such if an Administrative user can be tricked into visiting a site with a malicious form, it is possible to...