CVE-2023-2495

The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtransajaxold AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF...

CVE-2023-2495

The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtransajaxold AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF...

MAL-2022-1217 Malicious code in aysa-slugs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b2e4e72361b1a49a15220bdb45f0d7e10a866e7ea79c54c8a1ac82beef41794 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aysa-slugs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b2e4e72361b1a49a15220bdb45f0d7e10a866e7ea79c54c8a1ac82beef41794 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress 4.2.x < 4.2.31 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS vulnerability through post slugs. - An object injection vulnerability in some multisite installations. - A SQL injection vulnerability in...

WordPress 4.8.x < 4.8.18 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS vulnerability through post slugs. - An object injection vulnerability in some multisite installations. - A SQL injection vulnerability in...

WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs

Description Low-privileged authenticated users like author in WordPress core are able to execute JavaScript/perform stored XSS attack via post slugs, which can affect high-privileged users...

DEBIAN-CVE-2021-44223

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin...

Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting

The plugin does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin. Go to Setting Tab Under Calendar Lite Plugin Under Setting tab Click on Slugs/Permalinks tab Enter the XSS payload into Main Slug and Category Slug both. Both fields are vulnerable...

Cross-Site Scripting (XSS)

WordPress is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via post slugs...

DEBIAN-CVE-2020-28038

WordPress before 5.5.2 allows stored XSS via post slugs...

CVE-2020-28038

WordPress before 5.5.2 allows stored XSS via post slugs...

UBUNTU-CVE-2020-28038

WordPress before 5.5.2 allows stored XSS via post slugs...

CVE-2020-28038

WordPress before 5.5.2 allows stored XSS via post slugs...

CVE-2020-28038

CVE-2020-28038 affects WordPress prior to 5.5.2, where stored XSS via post slugs is possible. The connected Nessus/Fedora entries confirm WordPress 5.5.2/5.5.3 maintenance releases addressing CVE-2020-28038 and related fixes, with WordPress 5.5.2 patching the stored XSS in post slugs. The vulnera...

CVE-2020-28038

WordPress before 5.5.2 allows stored XSS via post slugs...

CVE-2020-28038

WordPress before 5.5.2 allows stored XSS via post slugs...

wordpress -- multiple issues

wordpress developers reports: Ten security issues affect WordPress versions 5.5.1 and earlier. If you havent yet updated to 5.5, all WordPress versions since 3.7 have also been updated to fix the following security issues: -Props to Alex Concha of the WordPress Security Team for their work in...

WordPress < 5.5.2 - Stored XSS in Post Slugs

Description The release notes state: "Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs."...

WordPress <= 5.5.1 - Stored Cross-Site Scripting (XSS) in Post Slugs vulnerability

Stored Cross-Site Scripting XSS in Post Slugs vulnerability found by Karim El Ouerghemmi in WordPress versions = 5.5.1. Solution Update the WordPress to the latest version at least 5.5.2...