CVE-2021-24632: Improper Neutralization of Input During Web Page Generation

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

PT-2021-16150

Name of the Vulnerable Software and Affected Versions The Recipe Card Blocks by WPZOOM WordPress plugin versions prior to 2.8.3 Description The issue concerns the improper sanitization or escaping of certain properties in the Recipe Card Block, such as ingredientsLayout, iconSet, steps,...

PT-2021-16148

Name of the Vulnerable Software and Affected Versions The Recipe Card Blocks by WPZOOM WordPress plugin versions prior to 2.8.1 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the message parameter is not properly escaped before being outputted back...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Recipe Card Blocks, which stems from a lack of proper validation of client-side data in the web application. An attacker can exploit this vulnerability to execu...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Recipe Card Blocks, which stems from a lack of proper validation of client-side data in the web application. An attacker can exploit this vulnerability to execu...

CVE-2021-24634: Improper Neutralization of Input During Web Page Generation

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings, which could allow users with a role as low as contributor to perfor...

WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 2.8.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Recipe Card Blocks for Gutenberg & Elementor plugin versions = 2.8.2. Solution Update the WordPress Recipe Card Blocks for Gutenberg & Elementor plugin to the latest available version at least 2.8.3...

WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 2.8.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Recipe Card Blocks for Gutenberg & Elementor plugin versions = 2.8.0. Solution Update the WordPress Recipe Card Blocks for Gutenberg & Elementor plugin to the latest available version at least 2.8.1...

Recipe Card Blocks < 2.8.1 - Reflected Cross-Site Scripting

The plugin does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/index.php?slactivation=false&message=%3Cscript%3Ealertorigin%3C%2Fscript%3E...

Recipe Card Blocks < 2.8.3 - Contributor+ Stored Cross-Site Scripting

The plugin does not properly sanitise or escape some of the properties of the Recipe Card Block such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks. As a...

Recipe Card Blocks < 2.8.3 - Contributor+ Stored Cross-Site Scripting

The plugin does not properly sanitise or escape some of the properties of the Recipe Card Block such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks. PoC As a...

Friday Squid Blogging: Linguine allo Scoglio Recipe

Delicious seafood pasta dish -- includes squid -- from Americas Test Kitchen. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

Binary Vulnerability in InoTouch Editor V2.6.8

Shenzhen Huichuan Technology Co., Ltd. focuses on the research and development, production and sales of industrial automation control products, positioning itself to serve the middle and high-end equipment manufacturers, based on the industrial automation control technology with independent...

CVE-2020-25454

Cross-site Scripting XSS vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe...

CVE-2020-25454

Cross-site Scripting XSS vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe...

Cross site scripting

Cross-site Scripting XSS vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe...

CVE-2020-25454

Cross-site Scripting XSS vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe...

CVE-2020-25454

CVE-2020-25454 affects grocy 2.7.1: a Cross-site Scripting (XSS) vulnerability in the add recipe module that executes when deleting a recipe. The issue is described as a stored XSS caused by input in the add recipe flow, with exploitation steps and payload demonstrated in the PacketStorm PoC for ...

CVE-2020-25454: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe...

PT-2020-16083

Name of the Vulnerable Software and Affected Versions grocy version 2.7.1 Description The issue is a Cross-site Scripting XSS vulnerability that occurs in the add recipe module of grocy. This vulnerability is executed when a recipe is deleted. Recommendations For grocy version 2.7.1, consider...