The vulnerability of the Quick Post Duplicator plugin of the WordPress content management system allows a hacker to gain unauthorized access to protected information and execute arbitrary SQL code.

The vulnerability of the Quick Post Duplicator plugin of the WordPress content management system is related to the lack of protection for the SQL query structure when processing the postid parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...

CVE-2023-2229

The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticate...

CVE-2023-2229

The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticate...

CVE-2023-2229 Quick Post Duplicator <= 2.0 - Authenticated (Contributor+) SQL Injection via post_id

The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticate...

CVE-2023-2229

CVE-2023-2229 affects the WordPress Quick Post Duplicator (rduplicator) up to version 2.0. The root cause is an SQL Injection via the post_id parameter due to insufficient escaping and lack of prepared statements, enabling authenticated attackers with contributor privileges to append additional S...

CVE-2023-2229: Improper Neutralization of Special Elements used in an SQL Command

The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticate...

WordPress plugin Quick Post Duplicator SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress WP Quick Post Duplicator Plugin <= 2.0 is vulnerable to Broken Access Control

Software WP Quick Post Duplicator Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-31214 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dab968364058 Credits TaeEun Lee Required...

WordPress Quick Post Duplicator Plugin <= 2.0 is vulnerable to SQL Injection

Software Quick Post Duplicator Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2229 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 82cd33300670 Credits Marco Wotschka Required privilege Contributor...

PT-2023-4737 · WordPress · Wp Quick Post Duplicator

Name of the Vulnerable Software and Affected Versions: Quick Post Duplicator for WordPress versions up to, and including, 2.0 Description: The issue is related to SQL Injection via the post id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation...

Cross site scripting

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CVE-2023-33194 CraftCMS stored XSS in Quick Post widget error message

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CVE-2023-33194

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CVE-2023-33194 CraftCMS stored XSS in Quick Post widget error message

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CraftCMS stored XSS in Quick Post widget error message

Summary The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Details Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. PoC 1. Login at admin 2. Go to setting 3. Create a Section 4. On Entry page, cli...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from the US-based Pixel & tonic, Inc. A security vulnerability exists in Pixel & tonic Craft CMS that stems from not filtering input and encoding output in Quick Post validation error messages, which would allow the delivery of loads with...

PT-2023-24211 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.4.6 Description: The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. An older issue fixed the XSS in label HTML but did not address it when...

CVE-2023-33194: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...

CVE-2023-23927

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...