Code injection

An issue in WooCommerce Payments plugin for WordPress versions 5.6.1 and lower allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the...

CVE-2023-28121

An issue in WooCommerce Payments plugin for WordPress versions 5.6.1 and lower allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the...

CVE-2023-29187

A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup Software Installation Program - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the...

CVE-2023-26466

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

CVE-2023-26466

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

CVE-2023-1425

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins...

CVE-2023-0874

The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress plugin All-In-One Security 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-26466

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

PT-2023-16045 · WordPress · All-In-One Security

Name of the Vulnerable Software and Affected Versions: All-In-One Security AIOS WordPress plugin versions prior to 5.1.5 Description: The issue allows an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server, to which the web server has access...

Cross site scripting

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Leonardo Giacone Easy Panorama plugin = 1.1.4 versions...

CVE-2023-25712

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-Buddy Google Analytics Opt-Out plugin = 2.3.4 versions...

CVE-2023-25023

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Saleswonder.Biz Webinar ignition plugin = 2.14.2 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Saleswonder.Biz Webinar ignition plugin = 2.14.2 versions...

CVE-2023-25022 WordPress Watu Quiz Plugin <= 3.3.8 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kiboko Labs Watu Quiz plugin = 3.3.8 versions...

CVE-2023-25023 WordPress WebinarIgnition Plugin <= 2.14.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Saleswonder.Biz Webinar ignition plugin = 2.14.2 versions...

CVE-2023-24398

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Snap Creek Software EZP Coming Soon Page plugin = 1.0.7.3 versions...

PT-2023-19564 · WordPress · Roland Murg Wp Booking System – Booking Calendar

Name of the Vulnerable Software and Affected Versions: Veribo, Roland Murg WP Booking System – Booking Calendar plugin versions = 2.0.18 Description: The issue is related to an Authenticated admin+ Cross-Site Scripting XSS vulnerability. This means that an attacker who has administrative access t...

PT-2023-22184 · Unknown · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: PI Websolution Product Enquiry for WooCommerce versions 2.2.12 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects th...

CVE-2023-29473

webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary commands on the platform operating system and achieve administrative access, aka OSFOURK-23710...