Portfolio for Elementor, Image Gallery & Post Grid | PowerFolio < 2.3.1 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Note: First,...

WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio Plugin < 2.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio Type Plugin Vulnerable versions 2.3.1 Fixed in 2.3.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2022-4765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership...

Qubely < 1.8.5 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Add the following Additional CSS classes to the "Post...

CVE-2022-2597

The WordPress plugin Visual Portfolio, Photo Gallery & Post Grid (version before 2.19.0) has missing authorization checks on some REST endpoints. This allows users with a low-privilege role (as low as contributor) to call these endpoints and inject arbitrary CSS into saved layouts. Affected: Visu...

CVE-2022-2543

The CVE-2022-2543 entry concerns the Visual Portfolio, Photo Gallery & Post Grid WordPress plugin prior to version 2.18.0. The issue is a lack of proper authorization checks in certain REST endpoints, enabling unauthenticated users to invoke endpoints and inject arbitrary CSS into saved layouts. ...

WordPress Post Grid,Slider

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Post Grid,Slider...

CVE-2022-1266

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress plugin Post Grid, Slider & Carousel Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Post Grid,Slider...

Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create a new Grid/Caroussel, in the General Settings, enable "Display Header Title" and put the...

WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.4.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fayçal CHENA in WordPress Post Grid, Slider & Carousel Ultimate plugin versions = 1.4.3. Solution Update the WordPress Post Grid, Slider & Carousel Ultimate plugin to the latest available version at least 1.5.0...

Wordpress Post Grid plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Post Grid plugin version 2.1.16 previously had a cross-site scripting vulnerability that could be exploited by attackers to...

Wordpress Post Grid plugin cross-site scripting vulnerability (CNVD-2022-44253)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress plugin Post Grid plugin version prior to 2.1....

CVE-2022-0447

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the posttypes parameter before outputting it back in the response of the postgridupdatetaxonomiestermsbyposttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting...

CVE-2022-0447

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the posttypes parameter before outputting it back in the response of the postgridupdatetaxonomiestermsbyposttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting...

CVE-2021-24986

The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form...

CVE-2021-24986

The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form...

Cross site scripting

The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form...

CVE-2022-0447 Post Grid < 2.1.16 - Reflected Cross-Site Scripting via post_types

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the posttypes parameter before outputting it back in the response of the postgridupdatetaxonomiestermsbyposttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting...

CVE-2021-24986 Post Grid < 2.1.16 - Reflected Cross-Site Scripting via keyword

The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form...

Wordpress plugin Post Grid 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Wordpress...