197 matches found
CVE-2022-3832
The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2022-24366 · WordPress · External Media
Name of the Vulnerable Software and Affected Versions: External Media WordPress plugin versions prior to 1.0.36 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example i...
VulnCheck KEV: CVE-2021-24311
The wpajaxupload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users...
CVE-2022-44586
Auth. admin+ Stored Cross-Site Scripting XSS in Ayoub Media AM-HiLi plugin = 1.0 on WordPress...
CVE-2022-1398
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks...
WordPress WebP Converter for Media plugin input validation error vulnerability
WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.The WordPress plugin WebP Converter for Media prior to version 4.0.3 is vulnerable to an input validation...
CVE-2021-24311
The wpajaxupload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users...
WordPress 插件代码问题漏洞
WordPress Plugin is an open source application plugin for WordPress. A code issue vulnerability exists in the WordPress plugin External Media that stems from the wp ajax upload-remote-file ajax operation being vulnerable to arbitrary file uploads from any authenticated user...
USN-4536-1 spip vulnerabilities
Youssouf Boulouiz discovered that SPIP incorrectly handled login error messages. A remote attacker could potentially exploit this to conduct cross-site scripting XSS attacks. CVE-2019-16392 Gilles Vincent discovered that SPIP incorrectly handled password reset requests. A remote attacker could...
USN-4536-1: SPIP vulnerabilities
Youssouf Boulouiz discovered that SPIP incorrectly handled login error messages. A remote attacker could potentially exploit this to conduct cross-site scripting XSS attacks. CVE-2019-16392 Gilles Vincent discovered that SPIP incorrectly handled password reset requests. A remote attacker could...
CVE-2019-6112
A Cross-site scripting XSS vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field...
CVE-2019-6112
A Cross-site scripting XSS vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field...
Cross site scripting
A Cross-site scripting XSS vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field...
CVE-2019-6112
WordPress Sell Media plugin v2.4.1 contains a Cross-Site Scripting (XSS) vulnerability in /inc/class-search.php, exploitable via the keyword parameter (search_term) to inject arbitrary script/HTML. Several connected sources (nuclei template, PatchStack, WPVulnDB) confirm remote exploitation and u...
Sell Media < 2.4.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
A Cross-site scripting XSS vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field. PoC https://example.com/sell-media-search/?keyword="...
GHSA-VRV8-V4W8-F95H Cross-site scripting vulnerability in TinyMCE
Impact A cross-site scripting XSS vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower a...
Cross-site scripting vulnerability in TinyMCE
Impact A cross-site scripting XSS vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower a...
GHSA-C78W-2GW7-GJV3 XSS in TinyMCE
Impact A cross-site scripting XSS vulnerability was discovered in: the core parser and media plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE...
CVE-2014-4535
CVE-2014-4535 is a cross-site scripting vulnerability in WordPress Import Legacy Media plugin (versions = 0.1 (or patch) as indicated by the sources. If exploitation details are not provided in a given document, they are not assumed here.”}
