CVE-2021-24982: Improper Neutralization of Input During Web Page Generation

The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting it back, leading to a Reflected Cross-Site Scripting in the admin dashboard...

CVE-2021-24940: Improper Neutralization of Input During Web Page Generation

The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. WordPress Better WordPress Google XML Sitemaps plugin version 1.4.1 and earlier versions are vulnerable to a cross-site scripting...

PT-2022-9518

Name of the Vulnerable Software and Affected Versions Persian Woocommerce WordPress plugin versions prior to 5.8.1 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the s parameter is not properly escaped before being outputted back in an attribute in...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Persian Woocommerce suffers from a cross-site scripting vulnerability that stems from not escaping the s...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. WordPress plugin is a WordPress application plugin. WordPress Child Theme Generator plugin version 2.2.7 and earlier versions have a cross-site scripting vulnerability that stems from the failure of the...

WordPress plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress Zero Spam plugin is a WordPress open source application plugin. SQL injection vulnerability exists in versions of WordPress Zero Spam plugin prior to 5.2.11. The vulnerability stems from t...

PT-2022-13072

Name of the Vulnerable Software and Affected Versions WordPress Zero Spam WordPress plugin versions prior to 5.2.11 Description The issue arises from the improper sanitization and escaping of the order and orderby parameters before they are used in a SQL statement within the admin dashboard,...

PT-2022-9545

Name of the Vulnerable Software and Affected Versions Child Theme Generator WordPress plugin versions prior to 2.2.8 Description The issue is related to a Reflected Cross-Site Scripting in the admin dashboard. This occurs because the parade parameter is not properly sanitised or escaped before...

CVE-2022-0147: Improper Neutralization of Input During Web Page Generation

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue...

PT-2022-13049

Name of the Vulnerable Software and Affected Versions The Better WordPress Google XML Sitemaps WordPress plugin versions prior to 1.4.2 Description The issue allows unauthenticated users to perform Stored Cross-Site Scripting attacks against admins due to the lack of sanitization and escaping of...

Sql injection

The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rmformid parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks...

CVE-2022-0420 RegistrationMagic < 5.0.2.2 - Admin+ SQL Injection

The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rmformid parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks...

Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting

The plugin does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a...

CVE-2022-0420: Improper Neutralization of Special Elements used in an SQL Command

The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rmformid parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks...

PT-2022-13169

Name of the Vulnerable Software and Affected Versions RegistrationMagic WordPress plugin versions prior to 5.0.2.2 Description The issue allows high privilege users to perform SQL injection attacks due to the lack of sanitization and escaping of the rm form id parameter in the Automation admin...

WordPress WP Cloudy plugin SQL injection vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.WordPress WP Cloudy plugin versions prior to 4.4.9 have a SQL injection vulnerability that stems from the...

CVE-2021-25112

The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-25112

The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-24864

The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the postid parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue...