285 matches found
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Paid Memberships Pro plugin has a cross-site scripting vulnerability in versions prior to 2.6.6, which stems...
Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting
The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=pmpro-discountcodes&s=s"+style=animation-name:rotation+onanimationstart=alert/XSS///...
WordPress Paid Memberships Pro plugin <= 2.6.5 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Paid Memberships Pro plugin versions = 2.6.5. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.6.6...
Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting
The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=pmpro-discountcodes=s"+style=animation-name:rotation+onanimationstart=alert/XSS///...
CVE-2021-20678
SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2021-20678
SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...
Sql injection
SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2021-20678
SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2021-20678
SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...
CVE-2021-20678
The CVE-2021-20678 entry concerns the WordPress plugin Paid Memberships Pro, prior to version 2.5.6. A SQL injection flaw allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. Impact is data disclosure/modification risk; exploitation details are not prov...
PT-2021-14137 · Unknown · Paid Memberships Pro
Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro versions prior to 2.5.6 Description: The issue allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. This can be exploited by attackers to manipulate database queries, potentiall...
WordPress plugin "Paid Memberships Pro" vulnerable to SQL injection
Overview WordPress Plugin "Paid Memberships Pro" contains an SQL injection vulnerability CWE-89. Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to the developer and coordinated on his own. After coordination was completed, this case was reported to JPCERT/CC, and...
JVN#08191557: WordPress plugin "Paid Memberships Pro" vulnerable to SQL injection
WordPress Plugin "Paid Memberships Pro" contains an SQL injection vulnerability CWE-89. Impact An attacker who can access Paid Membership Pro may obtain and/or alter the information stored in the database. Solution Update the plugin Update the plugin according to the information provided by the...
WordPress plugin Paid Memberships Pro SQL注入漏洞
WordPress plugin Paid Memberships Pro is an open source application plugin for WordPress. The plugin is designed for premium content sites, clubs/associations, subscription products, newsletters and more. Paid Memberships Pro versions prior to 2.5.6 suffers from a SQL injection vulnerability that...
WordPress Paid Memberships Pro plugin <= 2.5.2 - Insecure Direct Object Reference & sensitive information disclosure vulnerability
Insecure Direct Object Reference & sensitive information disclosure vulnerability found in WordPress Paid Memberships Pro plugin versions = 2.5.2. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.5.3...
WordPress Paid Memberships Pro plugin <= 2.5 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability found by Ron Masas from Checkmarx in WordPress Paid Memberships Pro plugin versions = 2.5. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.5.1...
Paid Memberships Pro < 2.5.1 - Authenticated Cross-Site Scripting (XSS)
The Paid Memberships Pro WordPress plugin, versions less than 2.5.1, were affected by an Authenticated Cross-Site Scripting XSS vulnerability in the 'page ' paramater of the Members List page of the dashboard...
WordPress Paid Memberships Pro plugin <= 2.4.2 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress Paid Memberships Pro plugin versions = 2.4.2. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.4.3...
WordPress Plugin "Paid Memberships Pro" vulnerable to SQL injection
Overview WordPress Plugin "Paid Memberships Pro" contains an SQL injection vulnerability CWE-89. Kenichi Okuno of Mitsui Bussan Secure Directions, Inc reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...