CVE-2024-2953 LuckyWP Table of Contents <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor permissio...

CVE-2023-6487

CVE-2023-6487 (LuckyWP Table of Contents for WordPress) stores cross-site scripting in the Header Title field across all versions up to 2.1.4 due to insufficient input sanitization and output escaping. exploitation requires authenticated, administrator-level access, and the issue affects multisit...

CVE-2023-6487 LuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-6487 LuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2119 LuckyWP Table of Contents <= 2.1.5 - Reflected Cross-Site Scripting

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

WordPress LuckyWP Table of Contents plugin <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Ivan Kuzymchak in WordPress Plugin LuckyWP Table of Contents versions = 2.1.4...

WordPress LuckyWP Table of Contents plugin <= 2.1.5 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin LuckyWP Table of Contents versions = 2.1.5...

CVE-2024-2953: Improper Neutralization of Input During Web Page Generation

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor permissio...

WordPress LuckyWP Table of Contents Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS)

Software LuckyWP Table of Contents Type Plugin Vulnerable versions = 2.1.4 Fixed in 2.1.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2953 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 31a9748ffaa2 Credits Ivan Kuzymchak...

CVE-2024-2119: Improper Neutralization of Input During Web Page Generation

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

PT-2024-18839 · WordPress · Luckywp Table Of Contents

Name of the Vulnerable Software and Affected Versions: LuckyWP Table of Contents plugin for WordPress versions up to, and including, 2.1.4 Description: The issue is related to Reflected Cross-Site Scripting via the attrs parameter due to insufficient input sanitization and output escaping. This...

CVE-2023-6487: Improper Neutralization of Input During Web Page Generation

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress LuckyWP Table of Contents Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

Software LuckyWP Table of Contents Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2119 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fd6e9deb644b Credits Lucio Sá...

PT-2024-14967 · WordPress · Luckywp Table Of Contents

Name of the Vulnerable Software and Affected Versions: LuckyWP Table of Contents plugin for WordPress versions up to and including 2.1.4 Description: The issue is related to Stored Cross-Site Scripting via the Header Title field due to insufficient input sanitization and output escaping. This...

LuckyWP Table of Contents <= 2.1.4 - Reflected Cross-Site Scripting

Description The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress TOP Table Of Contents plugin <= 1.3.15 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin TOP Table Of Contents versions = 1.3.15...

WordPress TOP Table Of Contents Plugin <= 1.3.15 is vulnerable to Cross Site Request Forgery (CSRF)

Software TOP Table Of Contents Type Plugin Vulnerable versions = 1.3.15 Fixed in 1.3.16 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32110 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b11059e9c542 Credits Dhabaleshwa...

BIT-JUPYTER-BASE-NOTEBOOK-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the...

Fedora: Security Advisory for atril (FEDORA-2024-59a7d96d84)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-Site Scripting

jupyterlab is vulnerable to Cross-Site Scripting. The vulnerability is due to there is no sanitization and escaping for markdown content, specifically in the Table of Contents extension. This allows an attacker to execute malicious scripts when a user previewed a markdown file...