CVE-2023-2280

CVE-2023-2280 affects the WordPress plugin WP Directory Kit. The issue is a missing capability check in the ajax_public function, enabling unauthenticated attackers to perform data-altering actions: delete or modify plugin settings, import demo data, delete related posts/terms, and install arbitr...

CVE-2023-2280 WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action

The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxpublic' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin...

CVE-2023-2280 WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action

The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxpublic' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin...

WordPress Plugin WP Directory Kit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-2835

The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-2835

The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Cross site scripting

The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-2835 WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'

The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-2835

WP Directory Kit for WordPress is affected by a Reflected XSS in the search parameter up to version 1.2.3 due to insufficient input sanitization/escaping. Exploitation requires user interaction (e.g., clicking a link). Patch 1.2.4 fixes this issue; update to 1.2.4+ or apply mitigations as describ...

PT-2023-21665 · WordPress · Wp Directory Kit

Name of the Vulnerable Software and Affected Versions: WP Directory Kit plugin for WordPress versions up to, and including, 1.2.3 Description: The issue is related to Reflected Cross-Site Scripting via the search parameter due to insufficient input sanitization and output escaping. This allows...

WordPress Plugin WP Directory Kit 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress WP Directory Kit Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Directory Kit Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2835 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 951b9caff7ba Credits Dongzhu Li Required...

WordPress WP Directory Kit Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Directory Kit Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2279 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b8d81b5ec5ec Credits Lana Codes Required...

WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection

Software WP Directory Kit Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A6: Security Misconfiguration Classification Open Redirection CVE CVE-2023-31229 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID e18f8bf074f1 Credits Nguyen Xuan Chien Required...