CVE-2023-1807

The CVE-2023-1807 entry concerns the Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress. The root cause is missing or incorrect nonce validation in the toggle_widget function, allowing Cross-Site Request Forgery. Affected are WordPress sites running Stax up to version 1.4.3. I...

CVE-2023-2189

CVE-2023-2189 affects Elementor Addons, Widgets and Enhancements – Stax for WordPress. Cause: missing capability check in toggle_widget (versions up to 1.4.3). Impact: authenticated users with subscriber-level permissions+ can enable/disable Elementor widgets. Patch status: Unpatched per Wordfenc...

WordPress Plugin Elementor Addons, Widgets and Enhancements – Stax 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Elementor Addons,...

WordPress Plugin Elementor Addons, Widgets and Enhancements–Stax 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2023-24212 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.4.6 Description: A malformed RSS feed can deliver an XSS payload. The issue can be triggered by the title in the tag of an RSS feed. For example, creating an RSS widget and adding a malicious RSS feed can lead to the...

PT-2023-23861 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central on-premise affected versions not specified Description: The issue concerns certain dashboard widgets that are susceptible to cross-site scripting XSS attacks. This could potentially allow an attacker to achieve remote...

PT-2023-3783

Name of the Vulnerable Software and Affected Versions Trend Micro Apex Central on-premise affected versions not specified Description The issue concerns certain dashboard widgets in Trend Micro Apex Central that are susceptible to cross-site scripting XSS attacks. This could potentially allow an...

PT-2023-3782 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central affected versions not specified Description: The issue exists due to inadequate protection of the web page structure in Trend Micro Apex Central, allowing for potential exploitation. This could enable a remote attacke...

CVE-2023-26517

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jeff Starr Dashboard Widgets Suite plugin = 3.2.1 versions...

CVE-2023-26517

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jeff Starr Dashboard Widgets Suite plugin = 3.2.1 versions...

CVE-2023-26517 WordPress Dashboard Widgets Suite Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jeff Starr Dashboard Widgets Suite plugin = 3.2.1 versions...

CVE-2023-26517 WordPress Dashboard Widgets Suite Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jeff Starr Dashboard Widgets Suite plugin = 3.2.1 versions...

WordPress plugin Dashboard Widgets Suite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2023-20696 · WordPress · Jeff Starr Dashboard Widgets Suite

Name of the Vulnerable Software and Affected Versions: Jeff Starr Dashboard Widgets Suite plugin versions prior to 3.2.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts...

WordPress plugin Dynamic Widgets SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

April 25, 2023—KB5025305 (OS Build 22621.1635) Preview

None None...

Widgets for Google Reviews Plugin for WordPress < 9.8 Cross-Site Scripting

The WordPress Widgets for Google Reviews Plugin installed on the remote host is affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

CVE-2015-10100

A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwidclass.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to versio...

Sql injection

A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwidclass.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to versio...

CVE-2015-10100

CVE-2015-10100 affects Dynamic Widgets Plugin for WordPress (versions up to 1.5.10). The vulnerability stems from SQL injection in the file classes/dynwid_class.php (or dynwid_class.php in related docs), enabling remote exploitation with no user interaction. Upgrading to version 1.5.11 addresses ...