CVE-2023-1016 Intuitive Custom Post Order <= 3.1.4.1 - Authenticated (Admin+) SQL Injection

The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.4.1, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'updateoptions' function as well as the...

CVE-2023-1016: Improper Neutralization of Special Elements used in an SQL Command

The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.4.1, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'updateoptions' function as well as the...

Google Map Shortcode <= 3.1.2 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin PoC Note: The...

WordPress Custom Post Type Generator Plugin <= 2.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Custom Post Type Generator Type Plugin Vulnerable versions = 2.4.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-33329 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 38a835231f46 Credits thiennv Requir...

CVE-2023-0542

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2023-0542

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

Cross site scripting

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2023-0542 Custom Post Type List Shortcode <= 1.4.4 - Contributor+ Stored XSS

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2023-0542 Custom Post Type List Shortcode <= 1.4.4 - Contributor+ Stored XSS

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

WordPress plugin Custom Post Type List Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2023-16348 · WordPress · Custom Post Type List Shortcode

Name of the Vulnerable Software and Affected Versions: Custom Post Type List Shortcode WordPress plugin versions 1.4.4 and earlier Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin's failure to validate and...

CVE-2023-0542: Improper Neutralization of Input During Web Page Generation

The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2023-25977

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in 9seeds.Com CPT – Speakers plugin = 1.1 versions...

WordPress Custom Post Type List Shortcode Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Custom Post Type List Shortcode Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0542 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 395cd0fac5ee Credits Istv...

WordPress Custom Post Type UI Plugin < 1.13.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Post Type UI Type Plugin Vulnerable versions 1.13.5 Fixed in 1.13.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-1623 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 181f1805c79c Credits Erwan LR Require...

Cross site request forgery (csrf)

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack...

CVE-2023-1623 Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack...

CVE-2023-1623

CVE-2023-1623 affects the WordPress plugin Custom Post Type UI prior to 1.13.5. The issue is a CSRF in the debug information sending flow to a user-supplied email, enabling a logged-in admin to cause that information to be sent to an arbitrary address. Impact is primarily on confidentiality (expo...

CVE-2023-1623 Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRF

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack...

CVE-2023-0420 Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF

The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF...