229 matches found
CVE-2024-2688
The CVE-2024-2688 entry concerns the WordPress plugin EmbedPress (all versions up to 3.9.12; 3.9.13 introduced a fix). Root cause: insufficient input sanitization and output escaping on EmbedPress widget attributes (embedpress_doc_custom_color). Impact: authenticated attackers with Contributor+ p...
CVE-2024-0825 Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object Injection
The Vimeography: Vimeo Video Gallery WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.2 via deserialization of untrusted input via the vimeographyduplicategalleryserialized in the duplicategallery function. This makes it possibl...
CVE-2024-0825
CVE-2024-0825 concerns the WordPress plugin “Vimeography: Vimeo Video Gallery” (
UNC4990 Leverage Hosting Platforms in USB Infection Chain
Summary: UNC4990, a financially motivated threat actor, has been observed targeting organizations in Italy by utilizing weaponized USB drives as an initial infection vector. Additionally, they are employing trusted websites such as Vimeo, GitHub, and Ars Technica to host encoded payloads disguise...
Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware
A financially motivated threat actor known as UNC4990 is leveraging weaponized USB devices as an initial infection vector to target organizations in Italy. Google-owned Mandiant said the attacks single out multiple industries, including health, transportation, construction, and logistics. "UNC499...
CVE-2023-30498
Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin = 2.2.1 versions...
CVE-2023-30498
CVE-2023-30498 affects CodeFlavors Vimeotheque (Vimeo WordPress Plugin) <= 2.2.1. Root cause: unauthenticated, reflected XSS via parameters such as view and page in the plugin’s output. Impact documented in multiple sources (Wordfence listing confirms Reflected XSS; Patchstack notes XSS with v...
WordPress YouTube Embed - YouTube Gallery, Vimeo Gallery - Wordpress Plugin Plugin <= 10.3 is vulnerable to Cross Site Scripting (XSS)
Software YouTube Embed - YouTube Gallery, Vimeo Gallery - Wordpress Plugin Type Plugin Vulnerable versions = 10.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...
CVE-2023-27443
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Grant Kimball Simple Vimeo Shortcode plugin = 2.9.1 versions...
Cross site scripting
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Grant Kimball Simple Vimeo Shortcode plugin = 2.9.1 versions...
CVE-2023-27443 WordPress Simple Vimeo Shortcode Plugin <= 2.9.1 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Grant Kimball Simple Vimeo Shortcode plugin = 2.9.1 versions...
CVE-2023-27443 WordPress Simple Vimeo Shortcode Plugin <= 2.9.1 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Grant Kimball Simple Vimeo Shortcode plugin = 2.9.1 versions...
CVE-2023-27443
CVE-2023-27443 affects the Grant Kimball Simple Vimeo Shortcode plugin for WordPress, specifically versions
PT-2023-21131 · WordPress · Grant Kimball Simple Vimeo Shortcode
Name of the Vulnerable Software and Affected Versions: Grant Kimball Simple Vimeo Shortcode plugin versions = 2.9.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher authentication levels...
WordPress plugin Simple Vimeo Shortcode 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2022-43646
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP...
CVE-2022-43646
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP...
CVE-2022-43646
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP...
Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Required theme:...
Simple Vimeo Shortcode <= 2.9.1 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...