PT-2023-27961 · WordPress · Store Locator

Name of the Vulnerable Software and Affected Versions: Store Locator WordPress plugin versions prior to 1.4.13 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape an invalid nonce before outputting it ba...

Locatoraid Store Locator < 3.9.24 - Reflected XSS

Description The plugin does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC Setup as admin: - Locatoraid Configuration Google Maps Enter "none" a...

CVE-2023-32576

Auth. subscriber+ Stored Cross-Site Scripting' vulnerability in Plainware Locatoraid Store Locator plugin = 3.9.18 versions...

CVE-2023-32576

Auth. subscriber+ Stored Cross-Site Scripting' vulnerability in Plainware Locatoraid Store Locator plugin = 3.9.18 versions...

CVE-2023-32576 WordPress Locatoraid Store Locator Plugin <= 3.9.18 is vulnerable to Cross Site Scripting (XSS)

Auth. subscriber+ Stored Cross-Site Scripting' vulnerability in Plainware Locatoraid Store Locator plugin = 3.9.18 versions...

CVE-2023-32576

CVE-2023-32576 affects the WordPress plugin Locatoraid Store Locator (Locatoraid) up to version 3.9.18. The issue is a Stored Cross-Site Scripting (XSS) vulnerability that requires Subscriber privileges to exploit. PatchStack confirms the fix was released in version 3.9.19. Public references also...

CVE-2023-32576 WordPress Locatoraid Store Locator Plugin <= 3.9.18 is vulnerable to Cross Site Scripting (XSS)

Auth. subscriber+ Stored Cross-Site Scripting' vulnerability in Plainware Locatoraid Store Locator plugin = 3.9.18 versions...

WordPress plugin Locatoraid Store Locator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-23883

Name of the Vulnerable Software and Affected Versions Plainware Locatoraid Store Locator plugin versions 3.9.18 and earlier Description The issue is related to a Stored Cross-Site Scripting vulnerability that affects authenticated users, specifically those with subscriber or higher privileges...

CVE-2023-32576: Improper Neutralization of Input During Web Page Generation

Auth. subscriber+ Stored Cross-Site Scripting' vulnerability in Plainware Locatoraid Store Locator plugin = 3.9.18 versions...

Store Locator WordPress < 1.4.13 - Reflected XSS

Description The plugin does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open the URL below...

Store Locator WordPress < 1.4.13 - Reflected XSS

Description The plugin does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open the URL below...

librsvg 路径遍历漏洞

librsvg is the GNOME project's library for rendering SVG images to the Cairo surface, which is used by GNOME to render SVG icons. It is used by GNOME to render SVG icons. It is also used by other desktop environments outside of GNOME for similar purposes. Wikimedia uses it for Wikipedia's SVG...

The vulnerability of the Ruby programming language’s URI component lies in the use of a regular expression c, which has an inefficient computational cost. This allows attackers to trigger a service failure.

The vulnerability of the Ruby programming language’s URI component is related to the incorrect handling of invalid URL addresses. Exploiting this vulnerability allows a remote attacker to cause service failures...

WordPress Store Locator Plus® – Gravity Forms Locations Plugin <= 6.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Store Locator Plus® – Gravity Forms Locations Type Plugin Vulnerable versions = 6.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 896b7ec0dce4 Credits Rafi...

WordPress VO Store Locator – WP Store Locator Plugin Plugin <= 3.3.0 is vulnerable to Cross Site Scripting (XSS)

Software VO Store Locator – WP Store Locator Plugin Type Plugin Vulnerable versions = 3.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 48d9000ab0fb Credits Rafie...

WordPress WP Store Locator – Extenders Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Store Locator – Extenders Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.4.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 54d6fd923761 Credits Rafie Muhammad...

DEBIAN-CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

Mozilla: Fullscreen notification obscured

The Mozilla Foundation Security Advisory describes this flaw as: A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks...

python: urllib.parse url blocklisting bypass

A flaw was found in the Python package. An issue in the urllib.parse component could allow attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.This may lead to compromised Integrity...