CVE-2021-25062

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25079

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page...

Code injection

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page...

Cross site scripting

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25062 Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25035: Improper Neutralization of Input During Web Page Generation

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25079: Improper Neutralization of Input During Web Page Generation

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page...

CVE-2021-25031: Improper Neutralization of Input During Web Page Generation

The Image Hover Effects Ultimate Image Gallery, Effects, Lightbox, Comparison or Magnifier WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS

The plugin does not have any authorisation and has a flawed CSRF check in the wpdevartduplicatepostparametrssaveindb AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of...

Anti-Malware Security and Brute-Force Firewall < 4.20.94 - Admin+ Reflected Cross-Site Scripting

The plugin does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user...

WordPress plugin跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Tutor LMS plugin for WordPress, versions prior to 1.9.12,...

PT-2022-9588

Name of the Vulnerable Software and Affected Versions Image Hover Effects Ultimate WordPress plugin versions prior to 9.7.1 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the effects parameter is not properly escaped before being outputted back in ...

PT-2022-9574

Name of the Vulnerable Software and Affected Versions The Tutor LMS WordPress plugin versions prior to 1.9.12 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the search parameter is not properly escaped before being outputted back in an attribute on...

PT-2022-9592

Name of the Vulnerable Software and Affected Versions Backup and Staging by WP Time Capsule WordPress plugin versions prior to 1.22.7 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the error parameter is not properly sanitised and escaped before...

WordPress plugin 跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. A cross-site scripting vulnerability exists in versions of the WordPress plugin WooCommerce prior to 1.1.10. The vulnerability stems from the fact that the WooCommerce WordPress plugin's order...

CVE-2021-25062: Improper Neutralization of Input During Web Page Generation

The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the fileurl before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-25017: Improper Neutralization of Input During Web Page Generation

The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...

WordPress plugin 跨站脚本漏洞

WordPress plugin is a WordPress open source application plugin . WordPress plugin Image Hover Effects Ultimate Image Gallery, Effects, Lightbox, Comparison or Magnifier plugin A cross-site scripting vulnerability exists in versions prior to 9.7.1, which stems from attributes that output back to t...

CVE-2021-25065

The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page...

CVE-2021-25067

The CVE-2021-25067 entry concerns the WordPress Landing Page Builder plugin (versions before 1.4.9.6). The vulnerability is a reflected XSS in the page-builder-add action on the ulpb_post admin page. The issue enables injection of malicious scripts via user-supplied input and may affect authentic...