WordPress WooCommerce Product Feed 2.2.18 Cross Site Scripting

Exploit Title: WordPress Plugin WooCommerce Product Feed = 2.2.18 - Cross-Site Scripting Date: 30 August 2019 Exploit Author: Damian Ebelties https://zerodays.lol/ Vendor Homepage: https://wordpress.org/plugins/webappick-product-feed-for-woocommerce/ Version: = 2.2.18 Tested on: Ubuntu 18.04.1 CV...

WooCommerce Product Feed for Google, Facebook, eBay and Many More < 3.1.15 - Authenticated Reflected XSS

The WooCommerce Product Feed for Google, Bing, eBay and Many More WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability...

WordPress WooCommerce Product Feed plugin <= 3.1.14 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by Damian Ebelties in WordPress WooCommerce Product Feed plugin versions = 3.1.14. Solution Update the WordPress WooCommerce Product Feed plugin to the latest available version at least 3.1.15...

WordPress Social LikeBox & Feed plugin <= 2.8.4 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Social LikeBox & Feed plugin versions = 2.8.4. Solution Update the WordPress Social LikeBox & Feed plugin to the latest available version at least 2.8.5...

WordPress WP Social Feed Gallery plugin <= 2.4.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress WP Social Feed Gallery plugin versions = 2.4.7. Solution Update the WordPress WP Social Feed Gallery plugin to the latest available version at least 2.4.8...

WordPress feed-them-social plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Facebook Feeds Load More button in versions of the WordPress...

WordPress WP Social Feed Gallery plugin <= 2.4.7 - Authorization Check vulnerability

Authorization Check vulnerability found in WordPress WP Social Feed Gallery plugin versions = 2.4.7. Solution Update the WordPress WP Social Feed Gallery plugin to the latest available version at least 2.4.8...

WordPress Social LikeBox & Feed plugin <= 2.8.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress Social LikeBox & Feed plugin versions = 2.8.4. Solution Update the WordPress Social LikeBox & Feed plugin to the latest available version at least 2.8.5...

WordPress feed-them-social plugin has unspecified vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress feed-them-social plugin versions prior to 1.7.0. An attacker can exploit the...

Cross site scripting

The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button...

WP Social Feed Gallery < 2.4.8 - CSRF & Missing Authorisation Checks

The lack of CSRF and Authorisations checks in some AJAX methods, such as qliggdismissnotice and qliggformitemdelete could allow attacker to perform unauthorised actions via actions when logged in as a low privilege user, or via CSRF attacks...

WordPress Custom Simple Rss Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Custom Simple Rss plugin is an RSS feed plugin used in it. A cross-site request forgery vulnerability exists in the Settings form in...

CVE-2019-1010124

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

CVE-2019-1010124

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

Cross site scripting

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

CVE-2019-1010124

WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting XSS. The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in...

PT-2019-11473 · Webappick +1 · Webappick Woocommerce Product Feed +1

Name of the Vulnerable Software and Affected Versions: WebAppick WooCommerce Product Feed versions 2.2.18 and earlier Description: The issue allows for Cross Site Scripting XSS which can lead to Remote Code Execution RCE via editing theme files in WordPress. This is possible when an administrator...

WordPress WebAppick WooCommerce Product Feed Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WebAppick WooCommerce Product Feed is a plugin used in WordPress to generate product feed data. A cross-site scripting...

CVE-2019-1010124

Summary: CVE-2019-1010124 affects WebAppick WooCommerce Product Feed (versions

Category Specific RSS feed Subscription <= 2.0 - Cross-Site Request Forgery (CSRF)

The Category Specific RSS feed Subscription WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...