CVE-2021-24979

The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-24979 Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting

The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-24979

The CVE-2021-24979 entry concerns the Paid Memberships Pro WordPress plugin (before 2.6.6). Affected component: admin page output uses the s parameter without escaping, enabling reflected XSS. According to the nuclei template, attackers can inject JavaScript via reflected XSS in the search parame...

PT-2021-16390

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro WordPress plugin versions prior to 2.6.6 Description: The issue concerns a Reflected Cross-Site Scripting problem. It occurs because the s parameter is not properly escaped before being outputted in an attribute on an adm...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Paid Memberships Pro plugin has a cross-site scripting vulnerability in versions prior to 2.6.6, which stems...

CVE-2021-24979: Improper Neutralization of Input During Web Page Generation

The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting

The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=pmpro-discountcodes=s"+style=animation-name:rotation+onanimationstart=alert/XSS///...

Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting

The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=pmpro-discountcodes&s=s"+style=animation-name:rotation+onanimationstart=alert/XSS///...

WordPress Paid Memberships Pro plugin <= 2.6.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Paid Memberships Pro plugin versions = 2.6.5. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.6.6...

OpenSSH 6.2 < 8.8

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with...

WordPress Subscriptions & Memberships for PayPal plugin <= 1.1.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Subscriptions & Memberships for PayPal plugin versions = 1.1.2. Solution Update the WordPress Subscriptions & Memberships for PayPal plugin to the latest available version at least 1.1.3...

CVE-2021-41617

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with...

CVE-2021-20678

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2021-20678

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2021-20678

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2021-20678

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2021-20678

The CVE-2021-20678 entry concerns the WordPress plugin Paid Memberships Pro, prior to version 2.5.6. A SQL injection flaw allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. Impact is data disclosure/modification risk; exploitation details are not prov...

CVE-2021-20678: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...