EUVD-2021-12188

Malware in sbrugna...

CVE-2022-0737

The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress Text Hover plugin cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Text Hover plugin, which stems from the fact that the plugin does not clean up and...

CVE-2022-0737

The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0737

The CVE-2022-0737 entry concerns the WordPress Text Hover plugin (versions before 4.2). The root cause is that the text to hover is not sanitized/escaped, enabling stored Cross-Site Scripting by users with elevated privileges, even when unfiltered_html is disallowed. Affected software: WordPress ...

CVE-2022-0737: Improper Neutralization of Input During Web Page Generation

The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13399

Name of the Vulnerable Software and Affected Versions Text Hover WordPress plugin versions prior to 4.2 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of the text to hover, even when the unfiltered html...

WordPress plugin: Text Hover – Cross-site scripting vulnerabilities

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Text Hover plugin, which stems from the fact that the plugin does not clean up and...

WordPress Text Hover plugin <= 4.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Rohan Chaudhari in WordPress Text Hover plugin versions = 4.1. Solution Update the WordPress Text Hover plugin to the latest available version at least 4.2...

Text Hover < 4.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC As admin, put the following in the plugin's settings: test = " Tick the "Enable text hover in...

CVE-2021-25277

FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component...

CVE-2021-25277: Improper Neutralization of Input During Web Page Generation

FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component...