160 matches found
WordPress WP ULike plugin <= 4.6.4 - Race Condition vulnerability
Race Condition vulnerability leading to rating increase/decrease discovered by Nguy Minh Tuan Patchstack Alliance in the WordPress WP ULike plugin versions = 4.6.3. Solution No patched version is available. No reply from the vendor since August 24th, 2022...
WordPress WP Ulike Access Control Error Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up personal blog sites.WP ULike is used in one of the website content interactive plugin. An access control error vulnerability exists in...
Improper access control
WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2...
Cross site scripting
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting XSS vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3...
CVE-2018-1000508
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting XSS vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3...
CVE-2018-1000511
WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2...
CVE-2018-1000508
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting XSS vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3...
CVE-2018-1000508
CVE-2018-1000508 affects WordPress WP ULike plugin versions 2.8.1 and 3.1, with a Cross-Site Scripting (XSS) vulnerability in the Settings page. The issue can allow unauthenticated or additional-privilege users to perform administrator-like actions by visiting the logs page. The vulnerability is ...
CVE-2018-1000511
WP ULike versions 2.8.1 and 3.1 contain an Incorrect Access Control vulnerability in AJAX that allows an attacker to delete arbitrary rows in certain database tables. The issue is exploitable by making an AJAX request; no exploitation status is provided in the sources. The vulnerability appears t...
CVE-2018-1000511
WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2...
PT-2018-9406
Name of the Vulnerable Software and Affected Versions WP ULike versions 2.8.1 through 3.1 Description The issue allows unauthorized users to perform administrative actions due to a Cross Site Scripting XSS vulnerability in the Settings screen. This can be exploited when an admin visits the logs...
CVE-2018-1000508: Improper Neutralization of Input During Web Page Generation
WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting XSS vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3...
CVE-2018-1000511: Incorrect Permission Assignment for Critical Resource
WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. This attack appear to be exploitable via Attacker must make AJAX request. This vulnerability appears to have been fixed in 3.2...
PT-2018-9409
Name of the Vulnerable Software and Affected Versions WP ULike versions 2.8.1 through 3.1 Description The issue is related to Incorrect Access Control in AJAX, allowing anybody to delete any row in certain tables. This can be exploited by making an AJAX request. Recommendations For WP ULike...
WordPress WP ULike plugin <= 3.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by Tom Adams dxw in WordPress WP ULike plugin versions = 3.1. Solution Update the WordPress WP ULike plugin to the latest available version at least 3.2...
WordPress WP ULike 2.8.1 / 3.1 Cross Site Scripting
Details ================ Software: WP ULike Version: 2.8.1,3.1 Homepage: https://wordpress.org/plugins/wp-ulike/ Advisory report: https://advisories.dxw.com/advisories/stored-xss-wp-ulike/ CVE: Awaiting assignment CVSS: 6.4 Medium; AV:N/AC:L/Au:N/C:P/I:P/A:N Description ================ Stored XS...
WordPress WP ULike 2.8.1 / 3.1 Arbitrary Data Deletion
Details ================ Software: WP ULike Version: 2.8.1,3.1 Homepage: https://wordpress.org/plugins/wp-ulike/ Advisory report: https://advisories.dxw.com/advisories/wp-ulike-delete-rows/ CVE: Awaiting assignment CVSS: 5.8 Medium; AV:N/AC:M/Au:N/C:N/I:P/A:P Description ================ WP ULike...
WordPress WP ULike 2.8.1 / 3.1 Arbitrary Data Deletion Vulnerability
WordPress WP ULike plugin versions 2.8.1 and 3.1 suffer from an arbitrary data deletion vulnerability. Details ================ Software: WP ULike Version: 2.8.1,3.1 Homepage: https://wordpress.org/plugins/wp-ulike/ Advisory report: https://advisories.dxw.com/advisories/wp-ulike-delete-rows/ CVE:...
WordPress WP ULike 2.8.1 / 3.1 Cross Site Scripting Vulnerability
WordPress WP ULike plugin versions 2.8.1 and 3.1 suffer from a persistent cross site scripting vulnerability. Details ================ Software: WP ULike Version: 2.8.1,3.1 Homepage: https://wordpress.org/plugins/wp-ulike/ Advisory report: https://advisories.dxw.com/advisories/stored-xss-wp-ulike...
