CVE-2020-35936

Stored Cross-Site Scripting XSS vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to...

CVE-2020-35936

Stored Cross-Site Scripting XSS vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to...

CVE-2020-35938

PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be...

Design/Logic Flaw

PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be...

Cross site scripting

Stored Cross-Site Scripting XSS vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to...

CVE-2020-35938

The CVE concerns the WordPress Post Grid plugin (versions prior to 2.0.73). The vulnerability is a PHP object injection caused by insecure unserialization of data supplied in a remotely hosted crafted payload sent via AJAX, targeting the action parameter post_grid_import_xml_layouts. An authentic...

CVE-2020-35938

PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be...

CVE-2020-35936

The CVE-2020-35936 entry concerns WordPress plugins Post Grid (and Team Showcase) with a Stored XSS in Post Grid prior to 2.0.73. The vulnerability arises when an authenticated user can import layouts via AJAX using the action post_grid_import_xml_layouts, allowing JavaScript payloads sourced fro...

PT-2021-11872

Name of the Vulnerable Software and Affected Versions: Post Grid plugin versions prior to 2.0.73 for WordPress Description: The issue allows remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the...

WordPress injection vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. A PHP object injection vulnerability exists in the Post Grid plugin for WordPress versions prior to 2.0.73. The vulnerability stems from unsafe deserialization of certain data in parameters. An...

WordPress Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Post Grid plugin before 2.0.73 for WordPress, whi...

com.amashchenko.struts2.pdfstream:struts2-pdfstream-plugin (2.0.0), com.amashchenko.struts2.pdfstream:struts2-pdfstream-showcase (2.0.0) +127 more potentially affected by CVE-2018-11776 via org.apache.struts:struts2-core (>=2.5, <=2.5.16)

org.apache.struts:struts2-core MAVEN version =2.5, =1.0.0-release, =2.5.0, =2.5.0, =4.0.1, =4.0.1, =4.0.1, =4.0.1, =4.0.3 - com.jgeppert.struts2.jquery:struts2-jquery-integration-tests 4.0.3 and more Source cves: CVE-2018-11776 Source advisory: GHSA-CR6J-3JP9-RW65...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +77 more potentially affected by CVE-2011-1772 via org.apache.struts:struts2-core (>=2.0.5, <=2.2.1.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =1.2.1, =0.6, =3.0-rc2, =2.4.0, =2.1.0, =3.0.2 and more Source cves: CVE-2011-1772 Source advisory: MEND:CVE-2011-1772...