CVE-2016-10976

The safe-editor plugin before 1.2 for WordPress has no sesave authentication, with resultant XSS...

CVE-2016-10976

The safe-editor plugin before 1.2 for WordPress has no sesave authentication, with resultant XSS...

CVE-2016-10976

The safe-editor plugin before 1.2 for WordPress has no sesave authentication, with resultant XSS...

Authentication flaw

The safe-editor plugin before 1.2 for WordPress has no sesave authentication, with resultant XSS...

CVE-2016-10976

The CVE concerns the WordPress Safe Editor plugin prior to version 1.2, where the se_save endpoint lacks authentication, enabling CSS/JS injection and resulting XSS. Affected component: safe-editor plugin for WordPress; root cause: missing authentication on se_save in admin-ajax flow; impact: una...

CVE-2016-10976

The safe-editor plugin before 1.2 for WordPress has no sesave authentication, with resultant XSS...

CVE-2016-10976: Improper Neutralization of Input During Web Page Generation

The safe-editor plugin before 1.2 for WordPress has no sesave authentication, with resultant XSS...

PT-2019-7769

Name of the Vulnerable Software and Affected Versions WordPress safe-editor plugin versions prior to 1.2 Description The issue concerns a lack of authentication in the safe-editor plugin, leading to a potential XSS exploit. Recommendations For versions prior to 1.2, update the safe-editor plugin ...

WordPress Safe Editor Plugin <= 1.1 - Multiple Vulnerabilities

This plugin is prone to an unauthenticated CSS and JS injection. The attackers can inject whatever they want when "wpfooter" and "wphead" is called, because "sesave" function is not sanitized. Solution Update the plugin...

safe-editor <= 1.1 - Unauthenticated CSS/JS-injection

When saving JS/CSS in this plugin then both private and public ajax-hooks are being used. Because of this anyone can post JS/CSS that are saved to the db and printed to the head and footer portion of the page. PoC In the file "index.php" in root folder on line 188 and 189 you can see that both...