259 matches found
Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access
The field shortcode included with the plugin, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved With the...
WordPress Display Post Metadata plugin cross-site scripting vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. display Post Metadata plugin is a WordPress open source application plugin. WordPress Display Post Metadata plugin ...
CVE-2021-24855
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...
CVE-2021-24872
The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata...
CVE-2021-24855
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...
CVE-2021-24855
CVE-2021-24855 affects the WordPress plugin Display Post Metadata (before 1.5.0). The vulnerability arises from unsanitised/unescaped content in a shortcode that prints custom fields, enabling stored Cross-Site Scripting for users with as low as Contributor. Impact is elevated to XSS through the ...
PT-2021-16337
Name of the Vulnerable Software and Affected Versions: Display Post Metadata WordPress plugin versions prior to 1.5.0 Description: The issue concerns the Display Post Metadata WordPress plugin, where a shortcode used to print out custom fields does not properly sanitise or escape the content. Thi...
CVE-2021-24855: Improper Neutralization of Input During Web Page Generation
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...
WordPress 插件安全漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blogging sites on PHP and MySQL servers. Get Custom Field Values Plugin is a WordPress open source application plugin. WordPress Get Custom Field Values...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. display Post Metadata plugin is a WordPress open source application plugin. WordPress Display Post Metadata plugin ...
CVE-2021-24729
The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...
CVE-2021-24729: Improper Neutralization of Input During Web Page Generation
The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase...
PT-2021-16232
Name of the Vulnerable Software and Affected Versions The Logo Showcase with Slick Slider WordPress plugin versions prior to 1.2.4 Description The issue allows users with a role as low as Author to perform stored Cross-Site Scripting attacks. This is due to the lack of sanitization in the Grid...
WordPress Display Post Metadata plugin <= 1.4.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Francesco Carlucci in WordPress Display Post Metadata plugin versions = 1.4.0. Solution Update the WordPress Display Post Metadata plugin to the latest available version at least 1.5.0...
Display Post Metadata < 1.5.0 - Contributor+ Stored Cross-Site Scripting
The plugin adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks - Login as contributor+ - Create a custom field containing XSS payload eg. alert1 - Add this...
Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
The plugin allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata. customfield field="fieldname" postid="ID" e.g customfield field="ctctverifykey" postid="23"...
Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access
The plugin allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata. PoC customfield field="fieldname" postid="ID" e.g customfield field="ctctverifykey" postid="23"...
WordPress Get Custom Field Values plugin <= 3.9.4 - Arbitrary Post Metadata Access vulnerability
Arbitrary Post Metadata Access vulnerability discovered by Francesco Carlucci in WordPress Get Custom Field Values plugin versions = 3.9.4. Solution Update the WordPress Get Custom Field Values plugin to the latest available version at least 4.0...