Cross site scripting

The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

CVE-2021-24739

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature...

CVE-2021-24739

CVE-2021-24739 involves the WordPress Logo Carousel plugin prior to 3.4.2. Affected: Logo Carousel WordPress plugin versions before 3.4.2. Issue: authorization flaw allowing users with role as low as Contributor to duplicate and view arbitrary private posts via the Carousel Duplication feature. R...

CVE-2021-24738

The CVE-2021-24738 entry concerns the WordPress Logo Carousel plugin prior to version 3.4.2. The vulnerability arises from a failure to validate and escape the “Logo Margin” option, enabling Stored Cross-Site Scripting (XSS) by users with as little as Contributor privileges. The issue is confirme...

CVE-2021-24738: Improper Neutralization of Input During Web Page Generation

The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

WordPress 插件授权问题漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress Logo Carousel plugin is vulnerable to authorization issues in versions prior to 3.4.2. The...

PT-2021-16239

Name of the Vulnerable Software and Affected Versions: Logo Carousel WordPress plugin versions prior to 3.4.2 Description: The issue concerns the Logo Carousel WordPress plugin, where the Logo Margin carousel option is not properly validated and escaped. This could allow users with a role as low ...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Logo Carousel plugin has a cross-site scripting vulnerability in versions prior to 3.4.2, which stems from a lack o...

CVE-2021-24739: Authorization Bypass Through User-Controlled Key

The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature...

PT-2021-7988

Name of the Vulnerable Software and Affected Versions Emerson Dixell XWEB-500 affected versions not specified Description The issue is related to an arbitrary file write vulnerability in the /cgi-bin/logo extra upload.cgi, /cgi-bin/cal save.cgi, and /cgi-bin/lo utils.cgi API endpoints. This...

WordPress WP Admin Logo Changer plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WP Admin Logo Changer plugin is a WordPress open source application plugin. WordPress WP Admin Logo Changer plugin in version 1.0 and earlier has a cross-site request forgery vulnerability, which...

CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2021-24784 WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

CVE-2021-24784

The CVE concerns the WordPress plugin “WP Admin Logo Changer” (versions

PT-2021-16279

Name of the Vulnerable Software and Affected Versions: WP Admin Logo Changer WordPress plugin versions 1.0 and earlier Description: The issue concerns a lack of CSRF check when saving settings, which could allow attackers to make a logged-in admin update them via a CSRF attack. Recommendations: F...

CVE-2021-24784: Cross-Site Request Forgery (CSRF)

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...

WordPress 插件跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WP Admin Logo Changer plugin is a WordPress open source application plugin. WordPress WP Admin Logo Changer plugin in version 1.0 and earlier has a cross-site request forgery vulnerability, which...

CVE-2021-24729

The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...