WordPress plugin 跨站脚本漏洞

WordPress plugin is a WordPress open source application plugin . WordPress plugin Image Hover Effects Ultimate Image Gallery, Effects, Lightbox, Comparison or Magnifier plugin A cross-site scripting vulnerability exists in versions prior to 9.7.1, which stems from attributes that output back to t...

Anti-Malware Security and Brute-Force Firewall < 4.20.94 - Admin+ Reflected Cross-Site Scripting

The plugin does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user...

CVE-2021-25065

The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page...

CVE-2021-25067

The CVE-2021-25067 entry concerns the WordPress Landing Page Builder plugin (versions before 1.4.9.6). The vulnerability is a reflected XSS in the page-builder-add action on the ulpb_post admin page. The issue enables injection of malicious scripts via user-supplied input and may affect authentic...

CVE-2021-25065

CVE-2021-25065 affects the Smash Balloon Social Post Feed WordPress plugin prior to version 4.1.1. The vulnerability is an authenticated reflected XSS in the custom-facebook-feed feature on the cff-top admin page. Connected sources specify the issue as a reflected XSS with impact potentially enab...

Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site Scripting

The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=cmplz-proof-of-consent=%22+style%3Danimation-name%3Ashine+onanimationstart%3Dalert%281%29+x%3D...

CVE-2021-25047

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...

Cross site scripting

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...

CVE-2021-25047

CVE-2021-25047 – 10Web Social Photo Feed Plugin : WordPress plugin versions before 1.4.29 are vulnerable to a reflected Cross-Site Scripting (XSS) on the wdi_apply_changes admin page, enabling an attacker to execute JavaScript in the context of any logged-in user. Root cause cited: lack of data v...

Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=woost&tab=%3Cimg+src+onerror%3Dalert%281%29%3E...

WordPress plugin跨站请求伪造漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The WordPress Modal Window plugin was vulnerable to cross-site request forgery prior to 5.2.2. The vulnerability stems from the plugin's failure to effectively filter calls to remote file resources...

All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin was vulnerable to reflected XSS on the my-sticky-elements-leads admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=my-sticky-elements-leads&search-contact;=xxxx%22%3E%3Cimg+src+onerror%3Dalert%281%29+x...

Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=woost=%3Cimg+src+onerror%3Dalert%281%29%3E...

CVE-2021-24963

The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-24963

The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the bookingtype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=cf7skins=%27%3E%3Cimg+src+onerror%3Dalert%281%29%3E requires the Contact Form 7 plugin to be installed...

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the wyppagetype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=yellow-pencil-editor=1pageid=homepagetype=homemode=singlepagetype=...

WordPress plugin Booking Calendar 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Booking Calendar. The vulnerability stems from the program not cleaning and...

WordPress plugin Chaty 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Chaty versions prior to 2.8.3 and WordPress...