Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Seed Webs Seed Fonts plugin = 2.3.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in gVectors Display Custom Fields – wpView plugin = 1.3.0 versions...

CVE-2023-25958

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Justin Saad Simple Tooltips plugin = 2.1.4 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPManageNinja LLC Ninja Tables plugin = 4.3.4 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ulf Benjaminsson WP-dTree plugin = 4.4.5 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Florin Arjocu Custom More Link Complete plugin = 1.4.1 versions...

CVE-2023-23733

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joel James Lazy Social Comments plugin = 2.0.4 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in CoreFortress Easy Event calendar plugin = 1.0 versions...

CVE-2023-26519

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alex Benfica Publish to Schedule plugin = 4.5.4 versions...

CVE-2023-25979

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Video Gallery by Total-Soft Video Gallery plugin = 1.7.6 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Include WP BaiDu Submit plugin = 1.2.1 versions...

CVE-2023-27614

Auth. admin+ Cross-Site Scripting XSS vulnerability in Ian Haycox Motor Racing League plugin = 1.9.9 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-Buddy Google Analytics Opt-Out plugin = 2.3.4 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin = 1.5.48 versions...

Cross site scripting

Auth. admin+ Cross-Site Scripting XSS vulnerability in Lester 'GaMerZ' Chan WP-CommentNavi plugin = 1.12.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Chameleon plugin = 1.4.3 on WordPress...

Broken Link Manager <= 0.6.5 - Authenticated (admin+) SQL Injection

The plugin does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue GET...

CVE-2020-4719

The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user with admin authorization to create DNS query strings that are not hostnames. IBM X-Force ID: 187861...

Shopify: H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link

Hi, This is unrelated to the Twine-template issue reported earlier as this would still be an issue if the template escape would be fixed. Background The incontextapplink is checked server-side if it's a correct shopifycloud.com-URL. The problem however is that userdata inside the URL is allowed. ...

Escalation Of Privileges

hadoop-hdfs is vulnerable to escalation of privileges. It does not check for admin authorization for the refreshNamenodes, deleteBlockPool and shutdownDatanode commands. This allows remotely authenticated attackers to perform these commands or cause denial of service attacks...