CVE-2022-4049 WP User <= 7.0 - Unauthenticated SQLi

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2022-4049 WP User <= 7.0 - Unauthenticated SQLi

The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2022-4519

The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

Cross site scripting

The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2022-4519

The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

WordPress plugin WP User 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2022-27422 · WordPress · Wp User

Name of the Vulnerable Software and Affected Versions: WP User plugin for WordPress versions up to, and including, 7.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's settings parameters due to insufficient input sanitization and output escaping. This allows...

GHSA-X5JC-34XF-C24Q User Plugin for October CSS Allows XSS

An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...

User Plugin for October CSS Allows XSS

An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...

WordPress WP User plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions prior to WordPress WP User plugin 7.0. The vulnerability stems...

CVE-2021-25034

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the wpuser shortcode is used, leading to Reflected Cross-Site Scripting issues...

WordPress Active User plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Active User plugin versions = 1.0.1. Solution No patched version available...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. cross-site scripting vulnerability exists in versions prior to WordPress WP User plugin 7.0. The vulnerability stems...

WordPress WP User plugin <= 6.5.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Jeremie Amsellem in WordPress WP User plugin versions = 6.5.1. Solution Update the WordPress WP User plugin to the latest available version at least 7...

PT-2021-10884

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.6.0 Valyria Description The issue is related to incorrect access control in Z-BlogPHP. It is possible to bypass authentication using PHP loose comparison and a magic hash. The passwordvisit input password function in zb...

GetSimple CMS Cross-Site Scripting Vulnerability (CNVD-2020-54918)

GetSimple CMS is a content management system CMS written in PHP. A cross-site request forgery vulnerability exists in the multi-user plugin 1.8.2 for GetSimple CMS, which stems from a lack of proper authentication of client-side data by the WEB application. An attacker can exploit the vulnerabili...

CVE-2020-23837

A Cross-Site Request Forgery CSRF vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin or other users after an authenticated admin visits a third-party site or clicks on a URL...

CVE-2020-23837

A Cross-Site Request Forgery CSRF vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin or other users after an authenticated admin visits a third-party site or clicks on a URL...

CVE-2020-23837

A Cross-Site Request Forgery CSRF vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin or other users after an authenticated admin visits a third-party site or clicks on a URL...

CVE-2020-23837

CVE-2020-23837 describes a CSRF vulnerability in the GetSimple CMS, specifically the Multi User plugin 1.8.2. The issue allows remote attackers to add admin (or other) users after an authenticated administrator visits a third‑party site or clicks a URL. The affected component is the Multi User pl...