9592 matches found
WordPress AMP Img Shortcode plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability
Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin AMP Img Shortcode versions = 1.0.1...
WordPress ML Responsive Audio plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerability
Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin ML Responsive Audio player with playlist Shortcode versions = 0.2...
WordPress AMP Img Shortcode Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)
Software AMP Img Shortcode Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51576 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c1c14fcefae0 Credits SOPROBRO Required privilege Contributo...
WordPress Reftagger Shortcode Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)
Software Reftagger Shortcode Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51612 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 461153da6fea Credits SOPROBRO Required privilege Contributo...
PT-2024-37656 · WordPress · Sip Reviews Shortcode
Name of the Vulnerable Software and Affected Versions: SIP Reviews Shortcode for WooCommerce plugin for WordPress versions up to, and including, 1.2.3 Description: The issue is related to Stored Cross-Site Scripting via the no of reviews attribute in the "woocommerce reviews" shortcode. This is d...
WordPress Emoji Shortcode Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Software Emoji Shortcode Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51609 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6ec03d2b4a66 Credits SOPROBRO Required privilege Contributor...
WordPress Display Terms Shortcode Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)
Software Display Terms Shortcode Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51610 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 332217e00b2c Credits SOPROBRO Required privilege...
WordPress plugin SIP Reviews Shortcode for WooCommerce SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...
WordPress Quran Shortcode Plugin <= 1.5 is vulnerable to SQL Injection
Software Quran Shortcode Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-51625 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID c3f04d230d13 Credits LVT-tholv2k Required privilege Contributor Published ...
WordPress plugin SIP Reviews Shortcode for WooCommerce SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...
WordPress WP Simple Anchors Links plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via wpanchor Shortcode vulnerability discovered by theviper17y in WordPress Plugin WP Simple Anchors Links versions = 1.0.0...
CVE-2024-8444
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting...
CVE-2024-10223
CVE-2024-10223 affects the WP Team – WordPress Team Member Plugin up to version 1.1.4. The vulnerability is a Stored Cross-Site Scripting (XSS) via the htteamember shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It requires authenticated access at...
CVE-2024-10108 WPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advertsadd shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...
CVE-2024-8444
CVE-2024-8444 concerns the WordPress Download Manager plugin prior to version 3.3.00. The vulnerability arises because certain shortcode parameters aren’t properly sanitized, enabling a cross-site scripting (XSS) issue. Affected product: Download Manager WordPress plugin (versions
CVE-2024-8627
The Ultimate TinyMCE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field' shortcode in all versions up to, and including, 5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2024-9846
The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running...
CVE-2024-9846
The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running...
CVE-2024-9846 Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Execution
The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running...