CVE-2023-0374

The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross site request forgery (csrf)

Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, suc...

CVE-2023-0889

CVE-2023-0889 affects Themeflection Numbers WordPress plugin pre-2.0.1. The vulnerability arises from missing authorization and CSRF checks in an AJAX action and failure to verify that updated options belong to the plugin, enabling any authenticated user (e.g., Subscriber) to update arbitrary blo...

PT-2023-16224 · WordPress · W4 Post List

Name of the Vulnerable Software and Affected Versions: W4 Post List WordPress plugin versions prior to 2.4.6 Description: The issue arises from the plugin's failure to validate and escape some of its block options before outputting them back in a page or post where the block is embedded. This cou...

CVE-2023-0374: Improper Neutralization of Input During Web Page Generation

The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0889: Undefined Security Weakness

Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, suc...

CVE-2023-29193 SpiceDB binding metrics port to untrusted networks and can leak command-line flags

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...

SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2023:1802-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1802-1 advisory. The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes. The following...

CVE-2023-1122

The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be...

CVE-2014-125096

CVE-2014-125096 affects Fancy Gallery Plugin 1.5.12 for WordPress. The vulnerability arises in an unknown function of the file class.options.php within the Options Page, enabling cross-site scripting through remote manipulation. Upgrading to version 1.5.13 addresses the issue (patch: fdf1f9e5a1ec...

WordPress plugin Fancy Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-25711

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPGlobus WPGlobus Translate Options plugin = 2.1.0 versions...

CVE-2023-25711

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPGlobus WPGlobus Translate Options plugin = 2.1.0 versions...

CVE-2023-25711 WordPress WPGlobus Translate Options Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPGlobus WPGlobus Translate Options plugin = 2.1.0 versions...

CVE-2023-25711

CVE-2023-25711 affects the WordPress WPGlobus Translate Options plugin (

CVE-2023-25711

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPGlobus WPGlobus Translate Options plugin = 2.1.0 versions...

CVE-2023-25711 WordPress WPGlobus Translate Options Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPGlobus WPGlobus Translate Options plugin = 2.1.0 versions...

CVE-2023-25711: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in WPGlobus WPGlobus Translate Options plugin = 2.1.0 versions...

WordPress Plugin WPGlobus Translate Options 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...