User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC An an admin -...

Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id

The plugin does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection PoC https://example/wp-admin/admin.php?page=fmweseditproduct=1+AND+SELECT+6037+FROM+SELECTSLEEP5Uiuu...

Note Press <= 0.1.10 - Admin+ SQLi via id

The plugin does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections PoC https://example.com/wp-admin/admin.php?page=NotePress-Main-Menu=view=17+AND+SELECT+3630+FROM+SELECTSLEEP5KdTt...

Note Press <= 0.1.10 - Admin+ SQLi via Update

The plugin does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection PoC POST /wp-admin/admin.php?page=NotePress-Main-Menu=edit=17 HTTP/1.1 Accept:...

CVE-2022-0428

The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-25086

The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it...

CVE-2022-1269

The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-25086

The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it...

Cross site scripting

The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it...

CVE-2022-1269

The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2022-1269 Fast Flow < 1.2.12 - Reflected Cross-Site Scripting

The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting...

PT-2022-13763 · WordPress · Fast Flow Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Fast Flow WordPress plugin versions prior to 1.2.12 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the page parameter is not properly sanitised and escaped before being outputted back in an...

PT-2022-9642 · WordPress · Advanced Page Visit Counter

Name of the Vulnerable Software and Affected Versions: Advanced Page Visit Counter WordPress plugin versions prior to 6.1.2 Description: The issue allows unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing the admin dashboard page, due to the plugin not...

PT-2022-13177

Name of the Vulnerable Software and Affected Versions Content Egg WordPress plugin versions prior to 5.3.0 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the page parameter is not properly sanitised and escaped before being outputted back in an...

StaffList < 3.1.5 - Admin+ SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection PoC https://example.com/wp-admin/admin.php?page=stafflist=test%'+AND+SELECT+42+FROM+SELECTSLEEP5b+AND+'aa%'='aa...

WordPress plugin Advanced Page Visit Counter 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress Advanced Page Visit Counter plug...

CVE-2021-25086: Improper Neutralization of Input During Web Page Generation

The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it...

CVE-2022-1269: Improper Neutralization of Input During Web Page Generation

The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2022-0428: Improper Neutralization of Input During Web Page Generation

The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting...