6735 matches found
CVE-2023-0874
The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress plugin All-In-One Security 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2023-26466
A user with non-Admin access can change a configuration file on the client to modify the Server URL...
PT-2023-16045 · WordPress · All-In-One Security
Name of the Vulnerable Software and Affected Versions: All-In-One Security AIOS WordPress plugin versions prior to 5.1.5 Description: The issue allows an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server, to which the web server has access...
Cross site scripting
Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Leonardo Giacone Easy Panorama plugin = 1.1.4 versions...
CVE-2023-25712
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-Buddy Google Analytics Opt-Out plugin = 2.3.4 versions...
CVE-2023-25023
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Saleswonder.Biz Webinar ignition plugin = 2.14.2 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Saleswonder.Biz Webinar ignition plugin = 2.14.2 versions...
CVE-2023-25022 WordPress Watu Quiz Plugin <= 3.3.8 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kiboko Labs Watu Quiz plugin = 3.3.8 versions...
CVE-2023-25023 WordPress WebinarIgnition Plugin <= 2.14.2 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Saleswonder.Biz Webinar ignition plugin = 2.14.2 versions...
CVE-2023-24398
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Snap Creek Software EZP Coming Soon Page plugin = 1.0.7.3 versions...
PT-2023-19564 · WordPress · Roland Murg Wp Booking System – Booking Calendar
Name of the Vulnerable Software and Affected Versions: Veribo, Roland Murg WP Booking System – Booking Calendar plugin versions = 2.0.18 Description: The issue is related to an Authenticated admin+ Cross-Site Scripting XSS vulnerability. This means that an attacker who has administrative access t...
PT-2023-22184 · Unknown · Woocommerce +1
Name of the Vulnerable Software and Affected Versions: PI Websolution Product Enquiry for WooCommerce versions 2.2.12 and earlier Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects th...
CVE-2023-29473
webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary commands on the platform operating system and achieve administrative access, aka OSFOURK-23710...
CVE-2023-1913
The Maps Widget for Google Maps for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in versions up to, and including, 4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission...
CVE-2023-25062
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin = 2.9.9.2.8 versions...
CVE-2023-24403
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP For The Win bbPress Voting plugin = 2.1.11.0 versions...
CVE-2023-24383
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Kiboko Labs Namaste! LMS plugin = 2.5.9.1 versions...