Code injection

Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an authenticated attacker who can control the ephemeral post update to access individual posts' contents in channels they are not a member of...

PT-2024-15219 · WordPress · Persian Fonts Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Persian Fonts WordPress plugin versions 1.6 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, i...

PT-2023-30625 · WordPress · Venutius Bp Profile Shortcodes Extra

Name of the Vulnerable Software and Affected Versions: Venutius BP Profile Shortcodes Extra plugin versions = 2.5.2 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This allows for potentially malicious...

PT-2023-22732 · Magepeople Team · Wpbusticketly

Name of the Vulnerable Software and Affected Versions: MagePeople Team WpBusTicketly plugin versions prior to 5.2.6 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For versions prior to 5.2....

PT-2023-20411 · Unknown · Wattisit Paygreen

Name of the Vulnerable Software and Affected Versions: WattIsIt PayGreen – Ancienne version plugin versions = 4.10.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actio...

PT-2023-30622 · Unknown · Bamboo Mcr Bamboo Columns Plugin

Name of the Vulnerable Software and Affected Versions: Bamboo Mcr Bamboo Columns plugin versions = 1.6.1 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. Recommendations: For Bamboo Mcr Bamboo Columns plugin...

PT-2023-23847 · Unknown · Himanshu Parashar Google Site Verification Plugin Using Meta Tag

Name of the Vulnerable Software and Affected Versions: Himanshu Parashar Google Site Verification plugin using Meta Tag versions 1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-30388 · Marco Milesi · Anac Xml Viewer Plugin

Name of the Vulnerable Software and Affected Versions: Marco Milesi ANAC XML Viewer plugin versions = 1.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Marco Milesi ANAC XML Viewer...

PT-2023-30478 · WordPress · Sendpress Newsletters

Name of the Vulnerable Software and Affected Versions: SendPress Newsletters plugin versions = 1.23.11.6 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

PT-2023-30484 · Codebard · Patron Button/Widgets For Patreon

Name of the Vulnerable Software and Affected Versions: CodeBard's Patron Button and Widgets for Patreon plugin versions = 2.1.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability requires PHP 8.x. Recommendations: For CodeBard's...

PT-2023-30534 · Cedcommerce · Cedcommerce Recently Viewed/Most Viewed Products Plugin

Name of the Vulnerable Software and Affected Versions: CedCommerce Recently viewed and most viewed products plugin versions prior to 1.1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with Auth Shop Manager+ permissions. Recommendations: F...

PT-2023-30496 · Unknown · Walter Pinem Oneclick Chat To Order

Name of the Vulnerable Software and Affected Versions: Walter Pinem OneClick Chat to Order plugin versions 1.0.4.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For...

PT-2023-30129 · WordPress · David Stöckl Custom Header Images

Name of the Vulnerable Software and Affected Versions: David Stöckl Custom Header Images plugin versions prior to 1.2.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-21249 · WordPress · Audrasjb Reusable Blocks Extended

Name of the Vulnerable Software and Affected Versions: audrasjb Reusable Blocks Extended plugin versions 0.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-22041 · Unknown · Robin Phillips Mobile Banner

Name of the Vulnerable Software and Affected Versions: Robin Phillips Mobile Banner plugin versions 1.5 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2023-20695 · WordPress · Wpindeed Debug Assistant

Name of the Vulnerable Software and Affected Versions: WPIndeed Debug Assistant plugin versions 1.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2023-21851 · Unknown · Marios Alexandrou Enhanced Plugin Admin

Name of the Vulnerable Software and Affected Versions: Marios Alexandrou Enhanced Plugin Admin plugin versions = 1.16 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

PT-2023-21123 · WordPress · Wpgrim Classic Editor/Classic Widgets

Name of the Vulnerable Software and Affected Versions: WPGrim Classic Editor and Classic Widgets plugin versions 1.2.5 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-23891 · WordPress · Wp Reactions Lite

Name of the Vulnerable Software and Affected Versions: WP Reactions Lite plugin versions 1.3.8 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the WP Reactions Lite plugin. This allows an attacker to perform unintended actions on a user's behalf. Recommendations: For WP...

PT-2023-24640 · WordPress · Wps Hide Login

Name of the Vulnerable Software and Affected Versions: LWS Hide Login plugin versions = 2.1.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...