CVE-2022-0737: Improper Neutralization of Input During Web Page Generation

The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13650

Name of the Vulnerable Software and Affected Versions The Page Security & Membership WordPress plugin versions 1.5.15 and earlier Description The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to perform...

CVE-2022-1001: Improper Neutralization of Input During Web Page Generation

The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not sanitise and escape it server side, allowing high privilege users such as admin to perform Cross-Site attacks even when the unfilteredhtml capability is...

PT-2022-13399

Name of the Vulnerable Software and Affected Versions Text Hover WordPress plugin versions prior to 4.2 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of the text to hover, even when the unfiltered html...

PT-2022-13582

Name of the Vulnerable Software and Affected Versions WP Downgrade versions prior to 1.2.3 Description The issue allows high privilege users, such as admins, to perform Cross-Site attacks. This is possible because the plugin only performs client-side validation of its "WordPress Target Version"...

PT-2022-13579

Name of the Vulnerable Software and Affected Versions Hummingbird WordPress plugin versions prior to 3.3.2 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks even when the unfiltered html capability is disallowed, due to the lack of...

CVE-2022-0969: Improper Neutralization of Input During Web Page Generation

The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfilteredhtml capability i...

PT-2022-13587

Name of the Vulnerable Software and Affected Versions Advanced Booking Calendar WordPress plugin versions prior to 1.7.1 Description The issue is related to the lack of sanitization and escaping of the id parameter when editing Calendars. This could allow high-privilege users, such as admins, to...

CVE-2022-1006: Improper Neutralization of Special Elements used in an SQL Command

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks...

PT-2022-13589

Name of the Vulnerable Software and Affected Versions One Click Demo Import WordPress plugin versions prior to 3.1.0 Description The issue allows high privilege users, such as admins, to upload arbitrary files, including PHP files, even when FILE MODS and FILE EDIT are disallowed, due to a lack o...

WordPress Hummingbird Cross Site Scripting

Tittle: WordPress Plugin Hummingbird Configs edit the "Name and Description" and put the following payload in the Name field: Save and Click 'Apply' to trigger the XSS Go to Hummingbird's Settings Configs and Upload the following config "id": 1, "name": "", "description": "Xss", "config":...

PT-2022-13557

Name of the Vulnerable Software and Affected Versions Mark Posts WordPress plugin versions prior to 2.0.1 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly escape new markers, even when...

PT-2022-13500

Name of the Vulnerable Software and Affected Versions Profile Builder WordPress plugin versions prior to 3.6.8 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape Form...

CVE-2021-45031

A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords...

CVE-2021-45031

A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords...

PT-2022-12294

Name of the Vulnerable Software and Affected Versions MEPSAN's USC+ versions prior to 3.0 Description A weakness in the login function of the affected software allows attackers to generate high-privileged account passwords. Recommendations For versions prior to 3.0, update to version 3.0 or later...

CVE-2022-0388

The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0493 String Locator < 2.5.0 - Admin+ Arbitrary File Read

The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be...

CVE-2022-0388: Improper Neutralization of Input During Web Page Generation

The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

mysql: Server: DML unspecified vulnerability (CPU Apr 2021)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...