Google Tag Manager for WordPress < 1.15.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the s parameter before outputting it back in a page when the search data is included in the data layer related settings is Basic data Search data...

WordPress Google Tag Manager plugin <= 1.15 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Cory Buecker and notstoppable in WordPress Google Tag Manager plugin versions = 1.15. Solution Update the WordPress Google Tag Manager plugin to the latest available version at least 1.15.1...

WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin <= 3.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin versions = 3.1.0. Solution Update the WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin to the latest available version at least 3.2.0...

WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin <= 3.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin versions = 3.1.0. Solution Update the WordPress Full Picture – Privacy-Focused Tag Manager & Cookie Notice plugin to the latest availab...

VDZ Google Analytics or Google Tag Manager / GTM < 1.4.9 - Authenticated Stored XSS

The plugin does not properly sanitise or escape some of its settings, allowing high privilege users such as admin to perform XSS attacks even when the unfilteredhtml capability is disallowed PoC Put the following payloads in the Google Analytics ID settings of the plugin...

VDZ Google Analytics or Google Tag Manager / GTM < 1.4.9 - Authenticated Stored XSS

The plugin does not properly sanitise or escape some of its settings, allowing high privilege users such as admin to perform XSS attacks even when the unfilteredhtml capability is disallowed Put the following payloads in the Google Analytics ID settings of the plugin...

VDZ Google Analytics or Google Tag Manager / GTM < 1.6.0 - Authenticated Stored XSS

The plugin does not escape its Google Analytics ID settings, allowing high privilege users such as admin to perform XSS attacks even when the unfilteredhtml capability is disallowed. The issue was introduced in v1.5.0, fixed in 1.5.4, then re-introduced in 1.5.5 and fixed in 1.6.0 Put the followi...

VDZ Google Analytics or Google Tag Manager / GTM < 1.6.0 - Authenticated Stored XSS

The plugin does not escape its Google Analytics ID settings, allowing high privilege users such as admin to perform XSS attacks even when the unfilteredhtml capability is disallowed. The issue was introduced in v1.5.0, fixed in 1.5.4, then re-introduced in 1.5.5 and fixed in 1.6.0 PoC Put the...

WordPress VDZ Google Analytics or Google Tag Manager / GTM plugin <= 1.4.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered in WordPress VDZ Google Analytics or Google Tag Manager / GTM plugin versions = 1.4.7. Solution Update the WordPress VDZ Google Analytics or Google Tag Manager / GTM plugin to the latest available version at least 1.4.9...

WordPress VDZ Google Analytics or Google Tag Manager / GTM plugin <= 1.5.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress VDZ Google Analytics or Google Tag Manager / GTM plugin versions = 1.5.5. Solution Update the WordPress VDZ Google Analytics or Google Tag Manager / GTM plugin to the latest available version at leas...

GHSA-5X33-H32W-6VR2 Cross site-scripting (XSS) moodle

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14...

Cross site-scripting (XSS) moodle

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14...

Hedgedoc Cross-Site Scripting Vulnerability

Hedgedoc is a Javascript-based Markdown document real-time editing and sharing platform by the Hedgedoc team. A security vulnerability exists in HedgeDoc versions prior to 1.7.1, which can be exploited to inject arbitrary "script" tags into HedgeDoc notes. Our content security policy prohibits...

CVE-2020-26287

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary script tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but www.google-analytics.com is...

CVE-2020-26287

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary script tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but www.google-analytics.com is...

CVE-2020-26287

Summary (CVE-2020-26287) : HedgeDoc prior to version 1.7.1 is vulnerable to cross-site scripting through injection of arbitrary [removed] tags in notes created via mermaid diagrams. The underlying issue stems from a permissive content security policy that allowed loading scripts from certain orig...

Hedgedoc 跨站脚本漏洞

Hedgedoc is a Javascript-based Markdown document real-time editing and sharing platform by the Hedgedoc team. A security vulnerability exists in HedgeDoc versions prior to 1.7.1, which can be exploited to inject arbitrary "script" tags into HedgeDoc notes. Our content security policy prohibits...

Cross-site Scripting (XSS)

moodle/moodle is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of sanitization of filter in the tag manager...

CVE-2020-25628

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14...

CVE-2020-25628

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14...