65 matches found
CVE-2024-9578 Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution
The Hide Links plugin for WordPress is vulnerable to unauthorized shortcode execution due to doshortcode being hooked through the commenttext filter in all versions up to and including 1.4.2. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the...
WordPress Hide Links Plugin <= 1.4.2 is vulnerable to Broken Authentication
Software Hide Links Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9578 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 4b4a91ec2385 Credits Francesco...
WordPress plugin Compute Links 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress Compute Links plugin <= 1.2.1 - Remote File Inclusion vulnerability
Remote File Inclusion vulnerability discovered by YCInfosec Patchstack Alliance in WordPress Plugin Compute Links versions = 1.2.1...
WordPress Compute Links Plugin <= 1.2.1 is vulnerable to Remote File Inclusion
Software Compute Links Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote File Inclusion CVE CVE-2024-43261 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID 6b5b6ec353fd Credits YCInfosec Required privilege Unauthenticate...
WordPress Floating Social Media Links plugin <=1.5.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Floating Social Media Links versions = 1.5.2...
CVE-2024-1308
The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalinksettingssave' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the...
CVE-2024-2326
The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possibl...
CVE-2024-2326 Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin <= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update
The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possibl...
PT-2024-19754 · WordPress · Pretty Links – Affiliate Links
Name of the Vulnerable Software and Affected Versions: The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress versions up to, and including, 3.6.3 Description: The issue is due to missing or incorrect nonce validation when saving plugin settings,...
CVE-2023-52175 WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Uno miunosoft Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1...
CVE-2023-52175 WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michael Uno miunosoft Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Affiliate Plugin: from n/a through 5.1.1...
WordPress Better Anchor Links Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF)
Software Better Anchor Links Type Plugin Vulnerable versions = 1.7.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-22287 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 4703f9e2f6d3 Credits Dimas Maulana...
CVE-2023-35097
CVE-2023-35097 affects WP Affiliate Links (Internet Marketing Dojo) plugin for WordPress, specifically versions ≤ 0.1.1. The vulnerability is unauthenticated reflected XSS in the plugin, enabling injection of malicious scripts via user-supplied input. Exploitation status is not detailed in the pr...
CVE-2023-26537 WordPress WP No External Links Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in nicolly WP No External Links plugin = 1.0.2 versions...
Cross site scripting
The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the tracklink function. This makes it possible for...
CVE-2019-25147 Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link
The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the tracklink function. This makes it possible for...
CVE-2019-25147 Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_link
The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the tracklink function. This makes it possible for...
CVE-2019-25147
The CVE-2019-25147 issue concerns the Pretty Links WordPress plugin. Affected product: WordPress plugin Pretty Links, versions up to and including 2.1.9. Root cause: insufficient input sanitization and output escaping in the track_link function, enabling Stored Cross-Site Scripting via various IP...
