1514 matches found
CVE-2023-29424
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Plainware ShiftController Employee Shift Scheduling plugin = 4.9.23 versions...
CVE-2023-3387 Lana Text to Image <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lanatexttoimage' and 'lanatexttoimg' shortcode in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...
CVE-2023-2401
The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-26515
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ko Takagi Simple Slug Translate plugin = 2.7.2 versions...
CVE-2023-3293
Cross-site Scripting XSS - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0...
SuiteCRM 跨站脚本漏洞
SuiteCRM is a customer relationship management system from the SuiteCRM team. A cross-site scripting vulnerability exists in suitecrm-core versions prior to 8.3.0. An attacker could exploit this vulnerability to perform stored cross-site scripting XSS attacks...
CVE-2023-33991
SAP UI5 Variant Management - versions SAPUI 750, SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, UI700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting Stored XSS vulnerability. After successful exploitation, an attacke...
CVE-2023-23818
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Aviplugins.Com WP Register Profile With Shortcode plugin = 3.5.7 versions...
CVE-2022-45827
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in GalleryPlugins Video Contest plugin = 3.2 versions...
PT-2023-6579 · 10Web · Seo By 10Web Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: SEO by 10Web WordPress plugin versions prior to 1.2.7 Description: The issue is related to the SEO by 10Web WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...
CVE-2023-2498
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inje...
PT-2023-14070 · Unknown · Jumpserver
Name of the Vulnerable Software and Affected Versions: Jumpserver versions 2.10.0 through 2.26.0 Description: The issue is related to multiple stored XSS vulnerabilities due to improper filtering of user input. This can lead to the execution of any javascript under admin's permission...
jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin
A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting XSS vulnerability that may allow attackers to...
CVE-2023-0233
The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-1649
The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2023-16393 · WordPress · Sloth Logo Customizer
Name of the Vulnerable Software and Affected Versions: Sloth Logo Customizer WordPress plugin versions prior to 2.0.3 Description: The issue concerns a lack of CSRF check when updating settings, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins add...
CVE-2023-26517
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jeff Starr Dashboard Widgets Suite plugin = 3.2.1 versions...
CVE-2023-23809
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Moris Dov Stock market charts from finviz plugin = 1.0.1 versions...
CVE-2023-1614
The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...