CVE-2023-0420 Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF

The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF...

WordPress Plugin Custom Post Type UI 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress plugin Custom Post Type and Taxonomy GUI Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-16258 · WordPress · Custom Post Type/Taxonomy Gui Manager

Name of the Vulnerable Software and Affected Versions: Custom Post Type and Taxonomy GUI Manager WordPress plugin version 1.1 Description: The issue is related to the lack of CSRF protection and insufficient sanitizing and escaping of parameters, allowing attackers to make a logged-in admin put...

CVE-2023-1623: Undefined Security Weakness

The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplied email, which could allow attackers to make a logged in admin send such information to an arbitrary email address via a CSRF attack...

PT-2023-17125 · WordPress · Custom Post Type Ui

Name of the Vulnerable Software and Affected Versions: Custom Post Type UI WordPress plugin versions prior to 1.13.5 Description: The issue arises from the plugin's failure to properly check for CSRF when sending debug information to a user-supplied email. This could allow attackers to make a...

CVE-2023-0420: Undefined Security Weakness

The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF...

WordPress Custom Post Type and Taxonomy GUI Manager Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Post Type and Taxonomy GUI Manager Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0420 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID de2781305d8c Credits...

WordPress Custom Post Type UI Plugin <= 1.13.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Post Type UI Type Plugin Vulnerable versions = 1.13.4 Fixed in 1.13.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9bee0fbba017 Credits Unknown Required privile...

CVE-2022-4385

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4386

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

CVE-2022-4386

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

Authorization

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4386 Intuitive Custom Post Order < 3.1.4 - Arbitrary Menu Order Update via CSRF

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

CVE-2022-4386

CVE-2022-4386 corresponds to a CSRF in the WordPress plugin Intuitive Custom Post Order, affecting versions up to 3.1.3. The update-menu-order AJAX action lacks CSRF protection, enabling an attacker to induce a user to change menu order. The entry notes vulnerability details and explicitly lists ...

CVE-2022-4385

Summary: The WordPress plugin Intuitive Custom Post Order (

CVE-2022-4385 Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4385 Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4386: Cross-Site Request Forgery (CSRF)

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

CVE-2022-4385: Missing Authorization

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...