WordPress WP Meta SEO plugin <= 4.4.8 - Social Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Social Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Rafie Muhammad aka Yeraisci Patchstack Alliance in WordPress WP Meta SEO plugin versions = 4.4.8. Solution Update the WordPress WP Meta SEO plugin to the latest available version at least 4.4.9...

WP Meta SEO < 4.4.9 - Social Settings Update via CSRF

The plugin does not have CSRF check in place when updating its social settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Malicious code in seo-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c37266af6c18bad1316dca279dd5472b77ca972098bb6af7c85853f6559d8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6014 Malicious code in seo-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c37266af6c18bad1316dca279dd5472b77ca972098bb6af7c85853f6559d8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gd-seo-central (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e84af23c0acb14aa345e90a3401849cf129e8f46715e6992d72cbe6c8ce95bfd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3317 Malicious code in gd-seo-central (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e84af23c0acb14aa345e90a3401849cf129e8f46715e6992d72cbe6c8ce95bfd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Chinese Hackers Distribute Backdoored Web3 Wallets for iOS and Android Users

A technically sophisticated threat actor known as SeaFlower has been targeting Android and iOS users as part of an extensive campaign that mimics official cryptocurrency wallet websites intending to distribute backdoored apps that drain victims' funds. Said to be first discovered in March 2022, t...

Creativeitem Academy-LMS Cross-Site Scripting Vulnerability

Creativeitem Academy-LMS, an online learning platform from Creativeitem, Inc. A cross-site scripting vulnerability exists in Creativeitem Academy-LMS v4.3, which stems from a lack of data validation filtering of user-supplied data and output in the SEO panel. An attacker could exploit this...

CVE-2022-29380

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting XSS vulnerability in the SEO panel...

CVE-2022-29380

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting XSS vulnerability in the SEO panel...

CVE-2022-29380

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting XSS vulnerability in the SEO panel...

Cross site scripting

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting XSS vulnerability in the SEO panel...

CVE-2022-29380

The connected records confirm CVE-2022-29380 affects Creativeitem Academy-LMS v4.3, with a stored cross-site scripting (XSS) vulnerability in the SEO panel. The root cause is described as a lack of data validation/filtering of user-supplied data and output in the SEO panel, enabling injection of ...

CVE-2022-29380

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting XSS vulnerability in the SEO panel...

WordPress WP Meta SEO plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of WordPress prior to WP Meta SEO plugin 4.4.7,...

CVE-2022-1093

The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed...

Hardcoded credentials

The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed...

CVE-2022-1093 WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs

The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed...

CVE-2022-1093

The WP Meta SEO WordPress plugin, prior to version 4.4.7, is vulnerable to a stored cross-site scripting (XSS) flaw in the breadcrumb separator. A high-privilege user (e.g., an administrator) can inject arbitrary JavaScript into pages where breadcrumbs are rendered, due to the separator not being...

WordPress plugin WP Contacts Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of WordPress prior to WP Meta SEO plugin 4.4.7,...