32 matches found
Uji Countdown <= 2.2 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. In the settings of the plugin add the...
WordPress Uji Countdown plugin <= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. Stored Cross-Site Scripting XSS vulnerability discovered by zhangyunpei in the WordPress Uji Countdown plugin versions = 2.2. Solution Deactivate and delete. This plugin has been closed as of November 9, 2022 and is not available for download. This closure is temporary, pending a full revie...
Uji Countdown <= 2.2 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. In the settings of the plugin add the payload ...
WordPress uji-countdown plugin cross-site scripting vulnerability
WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. uji-countdown is a countdown display plugin used in it. A cross-site scripting vulnerability exists in the WordPress...
CVE-2016-10900
The uji-countdown plugin before 2.0.7 for WordPress has XSS...
CVE-2016-10900
The uji-countdown plugin before 2.0.7 for WordPress has XSS...
Cross site scripting
The uji-countdown plugin before 2.0.7 for WordPress has XSS...
CVE-2016-10900
CVE-2016-10900 affects the WordPress plugin uji-countdown prior to version 2.0.7, introducing a cross-site scripting (XSS) vulnerability. Public sources consistently describe XSS without detailing the exploit path beyond the vulnerable plugin/version. The NVD notes a CVSS base of 6.1 (MEDIUM) (AV...
CVE-2016-10900
The uji-countdown plugin before 2.0.7 for WordPress has XSS...
WordPress Uji Countdown 2.0.6 Cross Site Scripting
------------------------------------------------------------------------ Cross-Site Scripting in Uji Countdown WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016 -----------------------------------------------------------------------...
WordPress Uji Countdown Plugin <= 2.0.6 - Cross-Site Scripting (XSS)
Because of this vulnerability, attackers can steal Administrators' session tokens, or perform arbitrary actions. Solution Update the plugin...