CVE-2020-29303: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with drtsformbuildid parameter containing the XSS payload and t paramet...

CVE-2020-29304: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through...

WordPress Directories Pro premium plugin <= 1.3.45 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by Jack Misiura The Missing Link in WordPress Directories Pro premium plugin versions = 1.3.45. Solution Update the WordPress Directories Pro premium plugin to the latest available version at least 1.3.46...

WordPress Directories Pro premium plugin <= 1.3.45 - Authenticated Self-Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Self-Reflected Cross-Site Scripting XSS vulnerability found by ack Misiura The Missing Link in WordPress Directories Pro premium plugin versions = 1.3.45. Solution Update the WordPress Directories Pro premium plugin to the latest available version at least 1.3.46...

PT-2020-17138

Name of the Vulnerable Software and Affected Versions SabaiApp Directories Pro plugin version 1.3.45 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a POST to "/wp-admin/admin.php?page=drts/directories&q=%2F" with the drts form build...

PT-2020-17139

Name of the Vulnerable Software and Affected Versions SabaiApps WordPress Directories Pro plugin versions prior to 1.3.46 Description A cross-site scripting XSS issue exists, allowing attackers to inject arbitrary web script or HTML by convincing a site administrator to import a specially crafted...

Directories Pro < 1.3.46 - Authenticated Self-Reflected Cross-Site Scripting

The plugin did not sanitise the column names when importing a malicious CSV file, allowing for HTML or JavaScript injection. PoC Iimport a CSV file containing the following in the header: 'term" autofocus onfocus=alert'Complex\u0020XSS';alertdocument.cookie;//'"...

Directories Pro < 1.3.46 - Authenticated Reflected Cross-Site Scripting

The plugin did not sanitise the drtsformbuildid parameter in a POST request to /wp-admin/admin.php?page=drts/directories, allowing for HTML or JavaScript injection...

Directories Pro < 1.3.46 - Authenticated Self-Reflected Cross-Site Scripting

The plugin did not sanitise the column names when importing a malicious CSV file, allowing for HTML or JavaScript injection. Iimport a CSV file containing the following in the header: 'term" autofocus onfocus=alert'Complex\u0020XSS';alertdocument.cookie;//'"...