CVE-2024-8714

CVE-2024-8714 (SliceWP Affiliates, WordPress) is a Reflected Cross-Site Scripting vulnerability in the SliceWP Affiliates plugin for WordPress, caused by improper escaping of URLs via remove_query_arg. Affected versions are

CVE-2024-8714 WordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site Scripting

The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.20. This makes it possible for unauthenticated attackers to...

WordPress plugin SliceWP Affiliates 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-39194 · WordPress · Slicewp Affiliates

Name of the Vulnerable Software and Affected Versions: SliceWP Affiliates plugin for WordPress versions up to, and including, 1.1.20 Description: The issue is related to Reflected Cross-Site Scripting due to the use of remove query arg without appropriate escaping on the URL. This allows...

WordPress Affiliates Plugin — SliceWP Affiliates < 1.1.11 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-34413

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: from n/a through 1.1.10...

CVE-2024-34413 WordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: from n/a through 1.1.10...

CVE-2024-34413

CVE-2024-34413 is a Stored XSS in the SliceWP Affiliates plugin for WordPress, affecting SliceWP Affiliates up to version 1.1.10. The vulnerability is authenticated (Admin+ required) and is documented as a vulnerability in Wordfence with patch status: Patched (no specific patched version provided...

CVE-2024-34413 WordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: from n/a through 1.1.10...

WordPress SliceWP Affiliates plugin <=1.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Manab Jyoti Dowarah Patchstack Alliance in WordPress Plugin SliceWP versions = 1.1.10...

WordPress plugin SliceWP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

PT-2024-25865 · Slicewp · Slicewp

Name of the Vulnerable Software and Affected Versions: SliceWP versions 1.1.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject maliciou...

WordPress SliceWP Plugin <=1.1.10 is vulnerable to Cross Site Scripting (XSS)

Software SliceWP Type Plugin Vulnerable versions =1.1.10 Fixed in 1.1.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34413 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c46a4aefe49b Credits Manab Jyoti Dowarah Required privilege...

SliceWP < 1.0.46 - Reflected Cross-Site Scripting (XSS)

The plugin does not escape the converted parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=slicewp-visits="...

WordPress SliceWP plugin <= 1.0.45 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress SliceWP plugin versions = 1.0.45. Solution Update the WordPress SliceWP plugin to the latest available version at least 1.0.46...

SliceWP < 1.0.46 - Reflected Cross-Site Scripting (XSS)

The plugin does not escape the converted parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/admin.php?page=slicewp-visits&converted="alert/XSS/...