PT-2023-19106 · Richard Leishman · Webforward Mail Subscribe List Plugin

Name of the Vulnerable Software and Affected Versions: Richard Leishman t/a Webforward Mail Subscribe List plugin versions 2.1.9 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the Richard Leishman t/a Webforward Mail Subscribe List...

WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" vulnerable to cross-site scripting

Overview WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" provided by Vektor,Inc. contain multiple cross-site scripting vulnerabilities CWE-79 listed below. Cross-site scripting vulnerability in Tag edit function - CVE-2023-27923 Cross-site scripting vulnerability in Post function ...

PT-2023-19169 · WordPress · Joel James Lazy Social Comments

Name of the Vulnerable Software and Affected Versions: Joel James Lazy Social Comments plugin versions = 2.0.4 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into the...

PT-2023-15089 · WordPress · Umair Saleem Woocommerce Custom Checkout Fields Editor With Drag & Drop

Name of the Vulnerable Software and Affected Versions: Umair Saleem Woocommerce Custom Checkout Fields Editor With Drag & Drop plugin versions = 0.1 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected...

PT-2023-19168 · Unknown · Joel James Disqus Conditional Load

Name of the Vulnerable Software and Affected Versions: Joel James Disqus Conditional Load plugin versions 11.0.6 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Joel James...

PT-2023-16515 · WordPress · Avirato Hotels Online Booking Engine

Name of the Vulnerable Software and Affected Versions: Avirato hotels online booking engine WordPress plugin versions 5.0.5 and earlier Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which are then used in SQL statements. This could allow...

PT-2023-18653 · Woocommerce · Chilidevs Return/Warranty Management System

Name of the Vulnerable Software and Affected Versions: chilidevs Return and Warranty Management System for WooCommerce plugin versions 1.2.3 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited without...

PT-2023-20698 · WordPress · Alex Benfica Publish To Schedule

Name of the Vulnerable Software and Affected Versions: Alex Benfica Publish to Schedule plugin versions 4.5.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions 4.5.4 a...

PT-2023-20428 · WordPress · Tauhidul Alam Simple Portfolio Gallery

Name of the Vulnerable Software and Affected Versions: Tauhidul Alam Simple Portfolio Gallery plugin versions = 0.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into...

PT-2023-20300 · WordPress · Alex Moss Firecask Like & Share Button

Name of the Vulnerable Software and Affected Versions: Alex Moss FireCask Like & Share Button plugin versions 1.1.5 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Alex Moss...

PT-2023-17156 · WordPress · Seopress

Name of the Vulnerable Software and Affected Versions: SEOPress WordPress plugin versions prior to 6.5.0.3 Description: The issue allows high-privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present, due to the unserialize of user input provided via the...

PT-2023-14777 · Unknown · Denis 微信机器人高级版

Name of the Vulnerable Software and Affected Versions: Denis 微信机器人高级版 plugin versions = 6.0.1 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, which will then be executed by the user's browser...

PT-2023-20308 · Unknown · Link Juice Keeper

Name of the Vulnerable Software and Affected Versions: Link Juice Keeper plugin versions prior to 2.0.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 2.0.3,...

PT-2023-19230 · WordPress · Webarea | Vera Nedvyzhenko Simple Pdf Viewer

Name of the Vulnerable Software and Affected Versions: WebArea | Vera Nedvyzhenko Simple PDF Viewer plugin versions = 1.9 Description: A Cross-Site Scripting XSS issue affects the plugin, potentially allowing unauthorized actions. The estimated number of affected devices and real-world incidents...

PT-2023-14776

Name of the Vulnerable Software and Affected Versions W3 Eden, Inc. Download Manager plugin versions 3.2.59 and earlier Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited without authentication, allowing for reflect...

PT-2023-21248 · Transbank · Transbank Webpay Rest Plugin

Name of the Vulnerable Software and Affected Versions: Transbank Webpay REST plugin versions = 1.6.6 Description: The issue is related to an SQL Injection vulnerability in the Transbank Webpay REST plugin. This allows for unauthorized access and potential data manipulation. Recommendations: For...

PT-2023-14520 · WordPress · Zephilou Cyklodev Wp Notify

Name of the Vulnerable Software and Affected Versions: Zephilou Cyklodev WP Notify plugin versions 1.2.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting vulnerability that requires authentication with admin+ privileges. There is no information provided about the...

PT-2023-19559 · WordPress · Ezp Coming Soon Page

Name of the Vulnerable Software and Affected Versions: EZP Coming Soon Page plugin versions = 1.0.7.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For EZP Coming Soon Page plugin...

PT-2023-21259 · Unknown · Rbs Image Gallery

Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery plugin versions prior to 3.2.13 Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability. This vulnerability affects the RoboSoft Photo Gallery, Images, Slider in the Rbs Image Gallery plugin...

PT-2023-15924 · WordPress · Wcfm Frontend Manager

Name of the Vulnerable Software and Affected Versions: WCFM Frontend Manager plugin for WordPress versions up to, and including, 6.6.0 Description: The issue allows unauthenticated attackers to perform various actions, such as modifying knowledge bases, notices, payments, managing vendors, and...