137 matches found
Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection
Description The plugin unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup :...
Estatik Real Estate Plugin < 4.1.1 - Reflected XSS
Description The plugin does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open one of the URLs below some...
Estatik Real Estate Plugin < 4.1.1 - Reflected XSS
Description The plugin does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open one of the URLs below some...
Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection
Description The plugin unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog PoC To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup...
Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update
Description The plugin does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset Run the below command in the developer console of the web browser while...
Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option Update
Description The plugin does not prevent user with low privileges on the site, like subscribers, from setting any of the site's options to 1, which could be used to break sites and lead to DoS when certain options are reset PoC Run the below command in the developer console of the web browser whil...
CVE-2023-28490
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...
CVE-2023-28490
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...
CVE-2023-28490 WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...
CVE-2023-28490 WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...
CVE-2023-28490
CVE-2023-28490 affects the Estatik Mortgage Calculator WordPress plugin versions
WordPress plugin estatik-mortgage-calculator Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Mortgage Calculator Estatik <= 2.0.7 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PT-2023-21755 · Estatik · Estatik Mortgage Calculator Plugin
Name of the Vulnerable Software and Affected Versions: Estatik Estatik Mortgage Calculator plugin versions = 2.0.7 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...
CVE-2023-40601
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...
CVE-2023-40601
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...
CVE-2023-40601 WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Estatik Estatik Mortgage Calculator plugin = 2.0.7 versions...