PT-2023-11844 · WordPress · Ultimate Addons For Gutenberg

Name of the Vulnerable Software and Affected Versions: The Ultimate Addons for Gutenberg plugin for WordPress versions up to, and including, 1.14.7 Description: The issue is due to missing capability checks on several AJAX actions, making it possible for authenticated attackers with subscriber+...

CVE-2023-2500

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'gopricing' shortcode 'data' parameter. This allows authenticated attackers, with subscriber-lev...

CVE-2023-22684

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...

CVE-2023-22684

CVE-2023-22684 is an authenticated stored Cross-Site Scripting (XSS) vulnerability in the Subscribers.Com Subscribers WordPress plugin, affecting versions up to 1.5.3. The issue requires admin+ privileges and can result in payloads stored by the plugin and reflected to users. Public risk context ...

CVE-2023-22684 WordPress Subscribers – Free Web Push Notifications Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...

CVE-2023-22684 WordPress Subscribers – Free Web Push Notifications Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...

CVE-2023-22684: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...

WordPress plugin Subscribers – Free Web Push Notifications 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2023-18629 · Subscribers.Com · Subscribers Plugin

Name of the Vulnerable Software and Affected Versions: Subscribers.Com Subscribers plugin versions 1.5.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions 1.5.3 and...

CVE-2022-41640

Auth. subscriber+ Stored Cross-Site Scripting XSS vulnerability in Rymera Web Co Wholesale Suite plugin = 2.1.5 versions...

PT-2023-14005

Name of the Vulnerable Software and Affected Versions Rymera Web Co Wholesale Suite plugin versions = 2.1.5 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication and affects subscribers. There is no information provided abo...

PT-2023-14763 · Martin Lees · Exxp Plugin

Name of the Vulnerable Software and Affected Versions: Martin Lees Exxp plugin versions = 2.6.8 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated subscribers. There is no information provided about the estimated number of potentially...

CVE-2023-0424

The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks...

CVE-2023-0388

The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...

Sql injection

The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...

CVE-2023-1414 WP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update

The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours...

CVE-2023-0424 MS-Reviews <= 1.5 - Subscriber+ Stored XSS

The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks...

CVE-2023-0388: Improper Neutralization of Special Elements used in an SQL Command

The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...

WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection

Software Email posts to subscribers Type Plugin Vulnerable versions = 6.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-46818 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID ac023e13840e Credits Le Ngoc Anh Required privilege...