339 matches found
PT-2023-16513
Name of the Vulnerable Software and Affected Versions The Gallery by BestWebSoft WordPress plugin versions prior to 4.7.0 Description The issue is related to a Blind SQL Injection vulnerability due to improper escaping of values used in SQL queries. An attacker must have at least the privileges o...
CVE-2023-0765: Improper Neutralization of Special Elements used in an SQL Command
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin https://wordpress.org/plugins/slider-bws/ must...
PT-2023-17011 · WordPress · The Slider
Name of the Vulnerable Software and Affected Versions: The Slider, Gallery, and Carousel by MetaSlider WordPress plugin version 3.29.0 Description: The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin. This occurs because the plugi...
WordPress Meta Slider Plugin <= 3.29.0 is vulnerable to Cross Site Scripting (XSS)
Software Meta Slider Type Plugin Vulnerable versions = 3.29.0 Fixed in 3.29.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1473 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID da45ef75e742 Credits Erwan LR WPScan Required...
Gallery by BestWebSoft < 4.7.0 - Author+ SQL Injection
The plugin does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin https://wordpress.org/plugins/slider-bws/ must also be installed for this vulnerability to b...
CVE-2022-45843
Auth. contributor+ Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin = 3.5.1.9 versions...
Cross site scripting
Auth. contributor+ Cross-Site Scripting XSS vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin = 6.0 versions...
CVE-2022-42485
CVE-2022-42485 affects the WordPress Gallery with thumbnail slider plugin versions prior to 6.0. The vulnerability is an Auth. (contributor+) stored Cross-Site Scripting (XSS) flaw in the plugin’s handling, enabling XSS by users with contributor or higher permissions. Affected component: Galaxy W...
CVE-2022-42485
Auth. contributor+ Cross-Site Scripting XSS vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin = 6.0 versions...
CVE-2022-42485: Improper Neutralization of Input During Web Page Generation
Auth. contributor+ Cross-Site Scripting XSS vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin = 6.0 versions...
PT-2023-14123 · Unknown · Galaxy Weblinks Gallery With Thumbnail Slider Plugin
Name of the Vulnerable Software and Affected Versions: Galaxy Weblinks Gallery with thumbnail slider plugin versions prior to 6.0 Description: A Cross-Site Scripting XSS issue affects the Galaxy Weblinks Gallery with thumbnail slider plugin, allowing unauthorized access for users with contributor...
CVE-2022-4664
The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Logo Slider < 3.6.0 - Contributor+ Stored XSS in Shortcode
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC Note: First, you need to add a Logo...
Cross site scripting
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in iFeature Slider plugin = 1.2 on WordPress...
CVE-2022-45375
The CVE-2022-45375 entry concerns WordPress iFeature Slider plugin ≤ 1.2, with an Auth. (contributor+) Stored Cross‑Site Scripting (XSS) vulnerability. The root cause is inadequate sanitisation/escaping of input parameters by the plugin, enabling a user with Contributor+ role to inject scripts th...
WordPress plugin iFeature Slider 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2022-27479 · Unknown · Ifeature Slider
Name of the Vulnerable Software and Affected Versions: iFeature Slider plugin version 1.2 and earlier Description: A Stored Cross-Site Scripting XSS issue exists, allowing contributors or higher to inject malicious scripts. Recommendations: For iFeature Slider plugin version 1.2 and earlier, upda...
CVE-2022-44741
Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS in David Anderson Testimonial Slider plugin = 1.3.1 on WordPress...
