6803 matches found
CVE-2023-0156
The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...
CVE-2023-32130
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Daniel Powney Multi Rating plugin = 5.0.6 versions...
CVE-2023-30752
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Silvia Pfeiffer and Andrew Nimmo External Videos plugin = 2.0.1 versions...
CVE-2023-5797
An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...
CVE-2023-23883
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in David Gwyer WP Content Filter plugin = 3.0.1 versions...
CVE-2023-23722
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Winwar Media WP eBay Product Feeds plugin = 3.3.1 versions...
CVE-2023-5621
The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2023-23733
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joel James Lazy Social Comments plugin = 2.0.4 versions...
CVE-2023-23370
An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have...
CVE-2023-23673
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Harish Chouhan, Themeist I Recommend This plugin = 3.8.3 versions...
CVE-2023-23987
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPEverest User Registration plugin = 2.3.0 versions...
CVE-2023-23875
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Himanshu Bing Site Verification plugin using Meta Tag plugin = 1.0 versions...
CVE-2023-23785
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in DgCult Exquisite PayPal Donation plugin = v2.0.0 versions...
CVE-2023-32496
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bill Minozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin = 7.31 versions...
CVE-2023-27610
Auth. admin+ SQL Injection SQLi vulnerability in TransbankDevelopers Transbank Webpay REST plugin = 1.6.6 versions...
CVE-2023-27584
Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...
CVE-2023-27415
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Themeqx LetterPress plugin = 1.1.2 versions...
CVE-2023-27426
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Notifyvisitors NotifyVisitors plugin = 1.0 versions...
CVE-2023-27592
Miniflux is a feed reader. Since v2.0.25, Miniflux will automatically proxy images served over HTTP to prevent mixed content errors. When an outbound request made by the Go HTTP client fails, the html.ServerError is returned unescaped without the expected Content Security Policy header added to...