Sql injection

The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page available via forced browsing is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection...

CVE-2021-24337: Improper Neutralization of Special Elements used in an SQL Command

The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page available via forced browsing is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection...

PT-2021-15873

Name of the Vulnerable Software and Affected Versions Video Embed WordPress plugin versions 1.0 and earlier Description The issue concerns the id GET parameter in one of the Video Embed WordPress plugin's pages, which is accessible via forced browsing. This parameter is not sanitized, validated, ...

PT-2021-15853

Name of the Vulnerable Software and Affected Versions Mediumish WordPress theme versions 1.0.0 through 1.0.47 Description The search feature of the Mediumish WordPress theme does not properly sanitise its s GET parameter before outputting it back to the page, leading to a Cross-Site Scripting...

CVE-2021-24300

The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue...

PT-2021-15837

Name of the Vulnerable Software and Affected Versions PickPlugins Product Slider for WooCommerce WordPress plugin versions prior to 1.13.22 Description The issue is related to the slider import search feature, which did not properly sanitize the keyword GET parameter, leading to a reflected...

giveasap 跨站脚本漏洞

giveasap is a WordPress plugin A security vulnerability exists in GIVEASAP that stems from the share GET parameter not being sanitized, validated, or escaped, thus leading to reflected XSS...

CVE-2021-24300: Improper Neutralization of Input During Web Page Generation

The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue...

WordPress plugin cross-site scripting vulnerability (CNVD-2021-36533)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in wpscan tha...

CVE-2021-24314

The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue...

CVE-2021-24314: Improper Neutralization of Special Elements used in an SQL Command

The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue...

CVE-2021-24283

The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue...

CVE-2021-24283

The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue...

CVE-2021-24283

The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue...

CVE-2021-24283: Improper Neutralization of Input During Web Page Generation

The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue...

CVE-2021-24239

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaioncode GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue...

Accordion < 2.2.30 - Authenticated Reflected Cross-Site Scripting (XSS)

The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue. PoC v 2.2.29 https://example.com/wp-admin/edit.php?posttype=accordions=settings=a%22%3E%3Csvg%2Fonload%3Dalert%28123%29%3B%2F%2F%3E%3C%22 v 2.2.30...

Acronis: Reflected XSS on my.acronis.com

Reflected XSS was possible on my.acronis.com via GET parameter "Error"...

WebCTRL-OperatorLocale-Parameter-Reflected-XSS

WebCTRL-OperatorLocale-Parameter-Reflected-XSS WebCTRL Ref...

CVE-2021-24154

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the downloadfile function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd...