RomethemeKit For Elementor < 1.4.2 - Missing Authorization

Description The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the addNewPost function in versions up to, and including, 1.4.1. This makes it possible for unauthenticated attackers to add new posts...

CVE-2022-28985

A stored cross-site scripting XSS vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...

PT-2022-19343

Name of the Vulnerable Software and Affected Versions OrangeHRM version v4.10.1 Description A stored cross-site scripting XSS issue in the addNewPost component allows attackers to execute arbitrary web scripts or HTML via a crafted POST request to the /api/v1/addNewPost endpoint, using vulnerable...

CVE-2022-28985: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...