WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WP Ultimate CSV Importer plugin prior to 6.4.3...

WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin < 2.4.13 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin versions 2.4.13. Solution Update the WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin to the latest available version at least 2.4.13...

WordPress Ultimate Widgets Light plugin <= 1.5.9.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Widgets Light plugin versions = 1.5.9.4. Solution No patched version available...

WordPress Ultimate Gutenberg – Custom Block Templates plugin <= 2.5.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Gutenberg – Custom Block Templates plugin versions = 2.5.1. Solution No patched version available...

PT-2022-13125 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: WP Ultimate CSV Importer WordPress plugin versions prior to 6.4.3 Description: The issue allows high privilege users to import malicious comments, potentially leading to Stored Cross-Site Scripting issues, due to the lack of sanitization and...

WordPress Ultimate Widgets Light plugin <= 1.5.9.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ultimate Widgets Light plugin versions = 1.5.9.4. Solution No patched version available...

WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin < 2.4.13 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin versions 2.4.13. Solution Update the WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin to the latest available version at least 2.4.13...

WordPress Ultimate Gutenberg – Custom Block Templates plugin <= 2.5.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ultimate Gutenberg – Custom Block Templates plugin versions = 2.5.1. Solution No patched version available...

CVE-2022-0360: Improper Neutralization of Input During Web Page Generation

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones either intentionnaly or not and lead to Stored Cross-Site Scripting issues...

CVE-2021-24993

The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example...

CVE-2021-24993

The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example...

CVE-2021-24993

The Ultimate Product Catalog WordPress plugin is affected pre-5.0.26 by missing authorization and CSRF checks in certain AJAX actions, allowing any authenticated user (e.g., a subscriber) to add arbitrary products or alter settings. Mitigation: update to version 5.0.26 or later; a PoC exists show...

Wordpress Plugin Ultimate Product Catalog 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2021-24993: Missing Authorization

The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example...

CVE-2022-23979

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability discovered in Ultimate Reviews WordPress plugin versions = 3.0.15...

CVE-2022-23979

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability discovered in Ultimate Reviews WordPress plugin versions = 3.0.15...

CVE-2022-23979

CVE-2022-23979 affects WordPress plugin Ultimate Reviews (versions ≤ 3.0.15). Affected component: the plugin’s handling of client-side data, leading to an authenticated Stored XSS when operated by admin+ users. Root cause: lack of proper validation/sanitisation of input by the web application (pe...

CVE-2022-23979 WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability discovered in Ultimate Reviews WordPress plugin versions = 3.0.15...

CVE-2022-23979: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability discovered in Ultimate Reviews WordPress plugin versions = 3.0.15...

WordPress plugin 跨站脚本漏洞

WordPress plugin is a WordPress application plugin. WordPress Ultimate Reviews plugin 3.0.15 and earlier versions contain a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit this vulnerability to...