90 matches found
CVE-2022-2072
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...
CVE-2022-2071
The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them...
CVE-2022-2071
The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them...
Cross site scripting
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...
CVE-2022-2072 Name Directory < 1.25.3 - Reflected Cross-Site Scripting
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...
CVE-2022-2072
CVE-2022-2072 affects the WordPress Name Directory plugin prior to 1.25.3. The vulnerability arises from insufficient sanitization/escaping of a parameter output back to the page, causing both Reflected and Stored XSS (payloads are saved to the database after the request). Connected sources confi...
CVE-2022-2071
CVE-2022-2071 affects the WordPress Name Directory plugin (versions prior to 1.25.4). The root cause is missing CSRF checks and insufficient sanitisation/escaping in imported data, enabling a logged-in admin to import names containing XSS payloads (stored XSS). Exploitation details in connected s...
WordPress plugin Name Directory 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Name Directory versions prior to 1.25.4 are vulnerable to cross-site request forgery, which...
WordPress plugin Name Directory 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...
Name Directory < 1.25.5 - Stored Cross-Site Scripting via CSRF
The plugin does not have CSRF check when adding/editing names, and is also lacking sanitisation as well as escaping in some of the fields, which could allow attackers to make a logged in admin edit arbitrary names and put XSS payloads in them. ' / " / ' /...
WordPress Name Directory plugin <= 1.25.4 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability
Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress Name Directory plugin versions = 1.25.4. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.25.5...
Name Directory < 1.25.4 - Arbitrary Directory/Name Deletion via CSRF
The plugin does not have CSRF checks in place when deleting Directories and Names, which could allow attackers to make a logged in admin delete them via a CSRF attack https://example.com/wp-admin/admin.php?page=name-directory&deletedir=2...
Name Directory < 1.25.4 - Arbitrary Directory/Name Deletion via CSRF
The plugin does not have CSRF checks in place when deleting Directories and Names, which could allow attackers to make a logged in admin delete them via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=name-directorydir=2...
Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRF
The plugin does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them. function submitRequest var xhr = new XMLHttpRequest;...
Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRF
The plugin does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them. PoC As admin, Import the following CSV...
WordPress Name Directory plugin <= 1.25.3 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability
Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Donato Di Pasquale in WordPress Name Directory plugin versions = 1.25.3. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.25.4...
WordPress Name Directory plugin <= 1.25.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Donato Di Pasquale in WordPress Name Directory plugin versions = 1.25.2. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.25.3...
Wordpress name-directory cross-site request forgery vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.Wordpress name-directory is a plugin that provides directory functionality for the Wordpress platform...
