CVE-2023-4471 Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting

The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the startdate and enddate parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2023-4471

The Order Tracking Pro WordPress plugin is vulnerable to Reflected Cross-Site Scripting via start_date and end_date in versions up to 3.3.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject web scripts into pages executed when a user is tr...

CVE-2023-4471 Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting

The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the startdate and enddate parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2023-4500 Order Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers admin or higher to inject...

CVE-2023-4500

CVE-2023-4500 – Order Tracking Pro (WordPress) Affected: Order Tracking Pro plugin for WordPress (

CVE-2023-4500: Improper Neutralization of Input During Web Page Generation

The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers admin or higher to inject...

WordPress plugin Order Tracking Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2023-29281 · WordPress · Order Tracking Pro

Name of the Vulnerable Software and Affected Versions: Order Tracking Pro plugin for WordPress versions up to, and including, 3.3.6 Description: The issue is related to Reflected Cross-Site Scripting via the start date and end date parameters due to insufficient input sanitization and output...

Order Tracking Pro < 3.3.7 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape the startdate and enddate parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-29342 · WordPress · Order Tracking Pro

Name of the Vulnerable Software and Affected Versions: Order Tracking Pro plugin for WordPress versions up to, and including, 3.3.6 Description: The issue is related to Stored Cross-Site Scripting via the order status parameter due to insufficient input sanitization and output escaping. This allo...

CVE-2023-4471: Improper Neutralization of Input During Web Page Generation

The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the startdate and enddate parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress plugin Order Tracking Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-4150

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks...

Cross site request forgery (csrf)

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks...

CVE-2023-4150

CVE-2023-4150 affects the WordPress plugin “User Activity Tracking and Log” (pre-4.0.9). Root cause: insufficient CSRF checks when managing the plugin license, enabling CSRF attacks to force logged-in admins to update or deactivate the license. Impact, per sources: license modification actions co...

WordPress plugin User Activity Tracking and Log 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists i...

PT-2023-27960 · WordPress · User Activity Tracking/Log

Name of the Vulnerable Software and Affected Versions: User Activity Tracking and Log WordPress plugin versions prior to 4.0.9 Description: The issue is related to a lack of proper CSRF checks when managing the license of the plugin. This could allow attackers to make logged-in admins update and...

CVE-2023-4150: Undefined Security Weakness

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks...

Chinese Hacking Group Exploits Barracuda Zero-Day to Target Government, Military, and Telecom

A suspected Chinese-nexus hacking group exploited a recently disclosed zero-day flaw in Barracuda Networks Email Security Gateway ESG appliances to breach government, military, defense and aerospace, high-tech industry, and telecom sectors as part of a global espionage campaign. Mandiant, which i...

WordPress Order Tracking Plugin <= 3.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Order Tracking Type Plugin Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4471 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 29d4142f0f03 Credits Marco Wotschka...