PT-2022-13866

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.5.8 Description The issue allows high privilege users, such as administrators, to upload PHP files disguised as images, which can contain malicious PHP code, due to...

PT-2022-13626

Name of the Vulnerable Software and Affected Versions th23 Social WordPress plugin versions prior to 1.2.1 Description The issue concerns the th23 Social WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

CVE-2022-1435: Improper Neutralization of Input During Web Page Generation

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1062: Improper Neutralization of Input During Web Page Generation

The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13807

Name of the Vulnerable Software and Affected Versions WP YouTube Live WordPress plugin versions prior to 1.8.3 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly validate, sanitize, and...

PT-2022-13865

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.5.8 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly...

PT-2022-9673

Name of the Vulnerable Software and Affected Versions AGIL WordPress plugin versions 1.0 and earlier Description The issue allows high-privilege users, such as admins, to upload arbitrary files, including PHP files, by accepting all zip files without validating the extracted file type, leading to...

PT-2022-13887

Name of the Vulnerable Software and Affected Versions WPCargo Track & Trace WordPress plugin versions prior to 6.9.5 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not sanitizin...

CVE-2022-0873: Improper Neutralization of Input During Web Page Generation

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is...

PT-2022-13490

Name of the Vulnerable Software and Affected Versions Gmedia Photo Gallery WordPress plugin versions prior to 1.20.0 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the Album's name is not properly sanitised and...

CVE-2022-1408: Improper Neutralization of Input During Web Page Generation

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1334: Improper Neutralization of Input During Web Page Generation

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1512: Improper Neutralization of Input During Web Page Generation

The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

Easy FAQ with Expanding Text <= 3.2.8.3.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed PoC Put the following payload in any of the plugin's settings such as Font size, Font Color and save: "...

CVE-2022-0898

The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfilteredhtml capability, which could lead to Stored Cross-Site Scripting issues...

CVE-2022-0898

The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfilteredhtml capability, which could lead to Stored Cross-Site Scripting issues...

CVE-2022-1303

The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2022-1338

The Easily Generate Rest API Url WordPress plugin through 1.0.0 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-1104

The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-1303

The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...