Hide Admin Bar Based on User Roles < 3.0.0 - Subscriber+ Settings Update

The plugin does not have authorisation and CSRF checks, allowing any authenticated users, such as subscriber, to update the plugin's settings https://example.com/wp-admin/admin-ajax.php?action=saveuserroles&caps=test&disableForAll=no...

Hide Admin Bar Based on User Roles < 3.1.0 - Settings Update via CSRF

The plugin does not have CSRF check when updating its settings, allowing attackers to make a logged in admin update the plugin's settings via a CSRF attack https://example.com/wp-admin/admin-ajax.php?action=saveuserroles&caps=test&disableForAll=no...

WordPress Hide Admin Bar Based on User Roles plugin <= 3.0.0 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Jan w Oleju in WordPress Hide Admin Bar Based on User Roles plugin versions = 3.0.0. Solution Update the WordPress Hide Admin Bar Based on User Roles plugin to the latest available version at least 3.1.0...

WordPress Hide Admin Bar Based on User Roles plugin <= 2.9.0 - Subscriber+ Settings Update vulnerability

Subscriber+ Settings Update vulnerability discovered by Jan w Oleju in WordPress Hide Admin Bar Based on User Roles plugin versions = 2.9.0. Solution Update the WordPress Hide Admin Bar Based on User Roles plugin to the latest available version at least 3.0.0...

CVE-2019-14770

In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the administrator is logged in and uses the search functionality. This issue is mitigated by the attacker needing permissions to create...

Shopify: Admin bar: Incomplete message origin validation results in XSS

This issue is very similar to https://hackerone.com/reports/381192, identical logic in a different script. The JavaScript code at https://cdn.shopify.com/s/assets/storefront/bars/adminbarinjector-7461c2cab955bf9ef3df40acd10741df8c4e27c86d9dc323f65a4e786a1786f2.js loaded by the shop front when the...