CVE-2023-2078: Missing Authorization

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for...

CVE-2023-25468: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Reservation.Studio Reservation.Studio widget plugin = 1.0.11 versions...

CVE-2023-2079: Cross-Site Request Forgery (CSRF)

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for unauthenticated...

WordPress Social Media Icons Widget Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Social Media Icons Widget Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25036 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d8722155f6da Credits Mika Required...

CVE-2023-26539

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Max Chirkov Advanced Text Widget plugin = 2.1.2 versions...

CVE-2023-23831

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Rating-Widget Rating-Widget: Star Review System plugin = 3.1.9 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Rating-Widget Rating-Widget: Star Review System plugin = 3.1.9 versions...

CVE-2023-23831

The CVE-2023-23831 vulnerability affects WordPress Rating-Widget: Star Review System plugin versions &lt;= 3.1.9 ( Patchstack also references

CVE-2023-25474

Cross-Site Request Forgery CSRF vulnerability in Csaba Kissi About Me 3000 widget plugin = 2.2.6 versions...

CVE-2023-25474

Cross-Site Request Forgery CSRF vulnerability in Csaba Kissi About Me 3000 widget plugin = 2.2.6 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Csaba Kissi About Me 3000 widget plugin = 2.2.6 versions...

CVE-2023-25474

CVE-2023-25474: CSRF vulnerability in the About Me 3000 widget for WordPress (Csaba Kissi) affecting versions 2.2.6 if available; PT-Security explicitly recommends CSRF token validation and restricting access to sensitive actions. Patch status is not consistently defined across documents; monito...

CVE-2023-25474: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Csaba Kissi About Me 3000 widget plugin = 2.2.6 versions...

CVE-2015-10101

A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be...

CVE-2015-10101

CVE-2015-10101 affects the Google Analytics Top Content Widget plugin for WordPress (up to version 1.5.6). The public details indicate an issue in an unknown functionality of the file class-tgm-plugin-activation.php that enables cross-site scripting (XSS). The vulnerability can be exploited remot...

CVE-2015-10101: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be...

CVE-2022-4763

The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege...

WordPress Amr Shortcode Any Widget Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Amr Shortcode Any Widget Type Plugin Vulnerable versions = 4.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4458 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 612057d81855 Credits Lana Codes...

WordPress Birthdays Widget plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Birthdays Widget plugin version 1.7.18 and earlier is vulnerable to a cross-site scripting...

The vulnerability of the Widget plugin and the Undo feature of the CKEditor WYSIWYG editor allows attackers to compromise data integrity.

The vulnerability of the Widget plugin and the Undo feature of the CKEditor WYSIWYG editor is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows an attacker to compromise the integrity of data...