PT-2022-9674

Name of the Vulnerable Software and Affected Versions Easy Social Feed Free and Pro WordPress plugins versions prior to 6.2.7 Description The issue is related to Reflected Cross-Site Scripting, where some parameters used via AJAX actions are not sanitized before being outputted back in the...

PT-2022-13377

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions prior to 2.11.6 Description The issue concerns a lack of CSRF check when inserting payment notes, potentially allowing attackers to make a logged admin insert arbitrary notes via a CSRF attack. Recommendations F...

PT-2022-13376

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads WordPress plugin versions prior to 2.11.6 Description The issue concerns the lack of sanitization and escaping of the Downloadable File Name in the Logs, potentially allowing high-privilege users to perform Cross-Site...

CVE-2022-0706: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...

WordPress和WordPress plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Digital Downloads plugin is vulnerable to cross-site request forgery, which originates from Ea...

WordPress plugin Easy Digital Downloads 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Digital Downloads plugin is vulnerable to a cross-site scripting vulnerability that stems from...

Exploit for Exposure of Private Personal Information to an Unauthorized Actor in Easyappointments

Easy!Appointments PII disclosure Easy!Appointments --...

Easy!Appointments < 1.4.3 - Information Disclosure Exploit

!/usr/bin/env ruby Exploit Title: Easy!Appointments 1.4.3 - Unauthenticated PII events disclosure Exploit author: noraj Alexandre ZANNI for ACCEIS https://www.acceis.fr Author website: https://pwn.by/noraj/ Exploit source: https://github.com/Acceis/exploit-CVE-2022-0482 Vendor Homepage:...

Easy!Appointments Information Disclosure

!/usr/bin/env ruby Exploit Title: Easy!Appointments 1.4.3 - Unauthenticated PII events disclosure Exploit author: noraj Alexandre ZANNI for ACCEIS https://www.acceis.fr Author website: https://pwn.by/noraj/ Exploit source: https://github.com/Acceis/exploit-CVE-2022-0482 Date: 2022-04-11 Vendor...

CVE-2022-0840

The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...

CVE-2022-0840

The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...

CVE-2022-0728

The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Design/Logic Flaw

The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...

CVE-2022-0840

The vulnerability is in the WordPress Easy Social Icons plugin (versions before 3.2.1). The image_file field is not properly escaped when adding a new social icon, enabling stored cross-site scripting. High-privilege users can inject arbitrary JavaScript even when unfiltered_html is disallowed. T...

CVE-2022-0840 Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon

The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...

CVE-2022-0728

The CVE-2022-0728 entry concerns the WordPress plugin Easy Smooth Scroll Links (prior to version 2.23.1). Affected component: plugin settings handling, which are not properly sanitized/escaped. Root cause: unfiltered input in plugin settings enables stored Cross-Site Scripting. Impact: could allo...

CVE-2022-0728 Easy Smooth Scroll Links < 2.23.1 - Admin+ Stored Cross-Site Scripting

The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13464

Name of the Vulnerable Software and Affected Versions Easy Social Icons WordPress plugin versions prior to 3.2.1 Description The issue allows high privileged users to inject arbitrary javascript, even when the unfiltered html capability is disallowed, due to improper escaping of the image file...

CVE-2022-0840: Improper Neutralization of Input During Web Page Generation

The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...

PT-2022-13394

Name of the Vulnerable Software and Affected Versions Easy Smooth Scroll Links WordPress plugin versions prior to 2.23.1 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and...