103 matches found
CVE-2022-40193 WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability in Awesome Filterable Portfolio plugin = 1.9.7 at WordPress...
CVE-2022-2597
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts...
CVE-2022-2597
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts...
CVE-2022-2543
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts...
PT-2022-17620 · WordPress · The Visual Portfolio
Name of the Vulnerable Software and Affected Versions: The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin versions prior to 2.19.0 Description: The issue is related to improper authorization checks in some REST endpoints of the plugin, allowing users with a role as low as contributo...
Admin user can change Portfolio Plugin hierarchy without WebSudo validation
Affected versions of Atlassian Jira Server and Data Centre allow remote attackers to modify the hierarchy structure of the Portfolio Plugin via a Broken Access Control vulnerability in the hierarchy configuration component. The affected versions are before version 8.20.4, and from version 8.21.0...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the WordPress Themify Portfolio Post...
Cross site scripting
The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dark parameter in the /titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2...
WordPress awesome-filterable-portfolio plugin SQL injection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. awesome-filterable-portfolio is a plugin that supports the creation, management and publishing of personal portfolios. A SQL injection...
Code injection
The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...
CVE-2018-18087
The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...
CVE-2018-18087
The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...
WordPress Portfolio Plugin <= 2.1.10 - Reflected Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Upgrade the plugin...
WordPress Portfolio Plugin <= 1.3.47 - Multiple XSS
These vulnerabilities allow an authenticated user to inject arbitrary web script or HTML via the 1. Media Title or 2. Media Subtitle fields. Solution Update the plugin...
CVE-2015-6523
Cross-site request forgery CSRF vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php...
CVE-2015-6523
The CVE-2015-6523 entry concerns the WordPress Portfolio plugin prior to version 1.05, where a Cross-Site Request Forgery (CSRF) flaw in the instagram-portfolio page of wp-admin/options-general.php allows remote attackers to hijack administrator authentication. The vulnerability arises from the p...
WordPress Portfolio 'options-general.php' plugin cross-site forgery vulnerability
WordPress is the WordPress Software Foundation a set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.Portfolio is one of the product showcase plugin. A cross-site forgery vulnerability in the WordPress Portfolio...
WordPress Portfolio 1.0 Cross Site Request Forgery Vulnerability
WordPress Portfolio plugin version 1.0 suffers from a cross site request forgery vulnerability. Title: Cross-Site Request Forgery Vulnerability in Portfolio Plugin Wordpress Plugin v1.0 Submitter: Nitin Venkatesh Product: Portfolio Plugin Wordpress Plugin Product URL:...
WordPress Portfolio 1.0 Cross Site Request Forgery
Title: Cross-Site Request Forgery Vulnerability in Portfolio Plugin Wordpress Plugin v1.0 Submitter: Nitin Venkatesh Product: Portfolio Plugin Wordpress Plugin Product URL: https://wordpress.org/plugins/portfolio-by-lisa-westlund/ Vulnerability Type: Cross-site Request Forgery CWE-352 Affected...
