524 matches found
CVE-2025-23912: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Philipp Speck WordPress Custom Sidebar wordpress-custom-sidebar allows Blind SQL Injection.This issue affects WordPress Custom Sidebar: from n/a through = 2.3...
PT-2025-5191
Name of the Vulnerable Software and Affected Versions Typomedia Foundation WordPress Custom Sidebar versions prior to 2.3 Description The issue is related to the improper neutralization of special elements used in an SQL command, allowing Blind SQL Injection. This problem enables attackers to...
WordPress plugin: WordPress Custom Sidebar SQL injection vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WordPress...
WordPress plugin Sidebar-Content from Shortcode has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...
WordPress plugin Strx Magic Floating Sidebar Maker has cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2025-4995 · Unknown · Pflonk Sidebar-Content From Shortcode
Name of the Vulnerable Software and Affected Versions: pflonk Sidebar-Content from Shortcode versions prior to 2.0 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This problem enabl...
CVE-2025-23827: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in straps Strx Magic Floating Sidebar Maker strx-magic-floating-sidebar-maker allows Stored XSS.This issue affects Strx Magic Floating Sidebar Maker: from n/a through = 1.4.1...
CVE-2025-23642: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pflonk Sidebar-Content from Shortcode sidebar-content-from-shortcode allows DOM-Based XSS.This issue affects Sidebar-Content from Shortcode: from n/a through = 2.0...
CVE-2024-10216
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'addsidebar' and 'removesidebar' functions in all versions up to, and including, 2.9.11. This makes it possible for authenticate...
WordPress WP User Manager plugin <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal vulnerability
Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal vulnerability discovered by BrokenAC ignore in WordPress Plugin WP User Manager versions = 2.9.11...
PT-2024-16120 · Unknown +1 · Wp User Manager +2
Name of the Vulnerable Software and Affected Versions: The WP User Manager – User Profile Builder & Membership plugin for WordPress versions up to, and including, 2.9.11 Description: The issue is related to a missing capability check on the add sidebar and remove sidebar functions. This allows...
CVE-2024-9885 Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, and including, 0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-9885 Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, and including, 0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
WordPress plugin Widget or Sidebar Shortcode cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...
CVE-2024-9885: Improper Neutralization of Input During Web Page Generation
The Widget or Sidebar Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sidebar' shortcode in all versions up to, and including, 0.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
PT-2024-39911 · WordPress · Widget/Sidebar Shortcode
Name of the Vulnerable Software and Affected Versions: Widget or Sidebar Shortcode plugin for WordPress versions up to and including 0.6.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'sidebar' shortcode, allowi...
WordPress Widget or Sidebar Shortcode Plugin <= 0.6.1 is vulnerable to Cross Site Scripting (XSS)
Software Widget or Sidebar Shortcode Type Plugin Vulnerable versions = 0.6.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9885 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 103d39e3e11c Credits theviper17y...
CVE-2024-8866: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in AutoCMS 5.4. It has been classified as problematic. This affects an unknown part of the file /admin/robot.php. The manipulation of the argument sidebar leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the...
AutoCMS cross-site scripting vulnerabilities
AutoCMS is a content management system CMS from AutoCMS Open Source. It helps dealers manage their website content, online advertising, social media and analytics. A cross-site scripting vulnerability exists in AutoCMS version 5.4, which originates in an unknown section of the /admin/robot.php...
