72 matches found
CVE-2023-23994 WordPress Auto Hide Admin Bar Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marcel Bootsman Auto Hide Admin Bar plugin = 1.6.1 versions...
CVE-2023-23994
The CVE-2023-23994 entry concerns the WordPress plugin Marcel Bootsman Auto Hide Admin Bar, vulnerable in versions <= 1.6.1. It is a Stored Cross-Site Scripting (XSS) flaw that requires authentication with admin+ privileges. The root cause is an XSS vulnerability in the plugin’s handling of in...
WordPress plugin Auto Hide Admin Bar 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...
WordPress Auto Hide Admin Bar Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)
Software Auto Hide Admin Bar Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23994 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6382baf7778a Credits yuyudhn Required...
WordPress Wp My Admin Bar plugin <= 3.1.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Wp My Admin Bar plugin versions = 3.1.0. Solution No patched version available...
WordPress Wp My Admin Bar plugin <= 3.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Wp My Admin Bar plugin versions = 3.1.0. Solution No patched version available...
WordPress Hide Admin Bar Based on User Roles plugin <= 3.0.0 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability
Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Jan w Oleju in WordPress Hide Admin Bar Based on User Roles plugin versions = 3.0.0. Solution Update the WordPress Hide Admin Bar Based on User Roles plugin to the latest available version at least 3.1.0...
Hide Admin Bar Based on User Roles < 3.1.0 - Settings Update via CSRF
The plugin does not have CSRF check when updating its settings, allowing attackers to make a logged in admin update the plugin's settings via a CSRF attack https://example.com/wp-admin/admin-ajax.php?action=saveuserroles&caps=test&disableForAll=no...
WordPress Hide Admin Bar Based on User Roles plugin <= 2.9.0 - Subscriber+ Settings Update vulnerability
Subscriber+ Settings Update vulnerability discovered by Jan w Oleju in WordPress Hide Admin Bar Based on User Roles plugin versions = 2.9.0. Solution Update the WordPress Hide Admin Bar Based on User Roles plugin to the latest available version at least 3.0.0...
Hide Admin Bar Based on User Roles < 3.0.0 - Subscriber+ Settings Update
The plugin does not have authorisation and CSRF checks, allowing any authenticated users, such as subscriber, to update the plugin's settings https://example.com/wp-admin/admin-ajax.php?action=saveuserroles&caps=test&disableForAll=no...
CVE-2019-14770
In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality. This issue is mitigated by the attacker needing permissions to create...
Shopify: Admin bar: Incomplete message origin validation results in XSS
This issue is very similar to https://hackerone.com/reports/381192, identical logic in a different script. The JavaScript code at https://cdn.shopify.com/s/assets/storefront/bars/adminbarinjector-7461c2cab955bf9ef3df40acd10741df8c4e27c86d9dc323f65a4e786a1786f2.js loaded by the shop front when the...