CVE-2023-0542 Custom Post Type List Shortcode <= 1.4.4 - Contributor+ Stored XSS

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2023-0542 Custom Post Type List Shortcode <= 1.4.4 - Contributor+ Stored XSS

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

PT-2023-16348 · WordPress · Custom Post Type List Shortcode

Name of the Vulnerable Software and Affected Versions: Custom Post Type List Shortcode WordPress plugin versions 1.4.4 and earlier Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and...

WordPress plugin Custom Post Type List Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2023-25977

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in 9seeds.Com CPT – Speakers plugin = 1.1 versions...

WordPress Custom Post Type UI Plugin < 1.13.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Post Type UI Type Plugin Vulnerable versions 1.13.5 Fixed in 1.13.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-1623 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 181f1805c79c Credits Erwan LR Require...

WordPress Custom Post Type List Shortcode Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Custom Post Type List Shortcode Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0542 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 395cd0fac5ee Credits Istv...

Cross site request forgery (csrf)

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack...

CVE-2023-1623

CVE-2023-1623 affects the WordPress plugin Custom Post Type UI prior to 1.13.5. The issue is a CSRF in the debug information sending flow to a user-supplied email, enabling a logged-in admin to cause that information to be sent to an arbitrary address. Impact is primarily on confidentiality (expo...

CVE-2023-1623 Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack...

CVE-2023-1623 Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack...

CVE-2023-0420 Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF

The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF...

CVE-2023-0420 Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF

The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF...

PT-2023-17125 · WordPress · Custom Post Type Ui

Name of the Vulnerable Software and Affected Versions: Custom Post Type UI WordPress plugin versions prior to 1.13.5 Description: The issue arises from the plugin's failure to properly check for CSRF when sending debug information to a user-supplied email. This could allow attackers to make a...

WordPress plugin Custom Post Type and Taxonomy GUI Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Plugin Custom Post Type UI 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-16258 · WordPress · Custom Post Type/Taxonomy Gui Manager

Name of the Vulnerable Software and Affected Versions: Custom Post Type and Taxonomy GUI Manager WordPress plugin version 1.1 Description: The issue is related to the lack of CSRF protection and insufficient sanitizing and escaping of parameters, allowing attackers to make a logged-in admin put...

WordPress Custom Post Type and Taxonomy GUI Manager Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Post Type and Taxonomy GUI Manager Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0420 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID de2781305d8c Credits...

WordPress Custom Post Type UI Plugin <= 1.13.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Post Type UI Type Plugin Vulnerable versions = 1.13.4 Fixed in 1.13.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9bee0fbba017 Credits Unknown Required privile...

CVE-2022-4385

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...