2394 matches found
CVE-2021-25065
CVE-2021-25065 affects the Smash Balloon Social Post Feed WordPress plugin prior to version 4.1.1. The vulnerability is an authenticated reflected XSS in the custom-facebook-feed feature on the cff-top admin page. Connected sources specify the issue as a reflected XSS with impact potentially enab...
Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site Scripting
The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=cmplz-proof-of-consent=%22+style%3Danimation-name%3Ashine+onanimationstart%3Dalert%281%29+x%3D...
CVE-2021-25047
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...
Cross site scripting
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...
CVE-2021-25047
CVE-2021-25047 – 10Web Social Photo Feed Plugin : WordPress plugin versions before 1.4.29 are vulnerable to a reflected Cross-Site Scripting (XSS) on the wdi_apply_changes admin page, enabling an attacker to execute JavaScript in the context of any logged-in user. Root cause cited: lack of data v...
Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=woost&tab=%3Cimg+src+onerror%3Dalert%281%29%3E...
WordPress plugin跨站请求伪造漏洞
WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The WordPress Modal Window plugin was vulnerable to cross-site request forgery prior to 5.2.2. The vulnerability stems from the plugin's failure to effectively filter calls to remote file resources...
All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)
The plugin was vulnerable to reflected XSS on the my-sticky-elements-leads admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=my-sticky-elements-leads&search-contact;=xxxx%22%3E%3Cimg+src+onerror%3Dalert%281%29+x...
Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=woost=%3Cimg+src+onerror%3Dalert%281%29%3E...
CVE-2021-24963
The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting...
CVE-2021-24963
The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting...
Cross site scripting
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the bookingtype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...
Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=cf7skins=%27%3E%3Cimg+src+onerror%3Dalert%281%29%3E requires the Contact Form 7 plugin to be installed...
Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the wyppagetype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=yellow-pencil-editor=1pageid=homepagetype=homemode=singlepagetype=...
WordPress plugin Chaty 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Chaty versions prior to 2.8.3 and WordPress...
WordPress plugin Booking Calendar 跨站脚本漏洞
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Booking Calendar. The vulnerability stems from the program not cleaning and...
WordPress plugin 跨站脚本漏洞
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Booster for WooCommerce, which stems from the program's failure to filter and...
Orange Form <= 1.0 - SQL Injection via CSRF
In the plugin, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers...
WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the woofredrawelements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin-ajax.php?action=woofdrawproductsredrawelements=%3Cimg%20src%20onerror=alert/XSS/%3E...