CVE-2021-25065

CVE-2021-25065 affects the Smash Balloon Social Post Feed WordPress plugin prior to version 4.1.1. The vulnerability is an authenticated reflected XSS in the custom-facebook-feed feature on the cff-top admin page. Connected sources specify the issue as a reflected XSS with impact potentially enab...

Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site Scripting

The plugin does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=cmplz-proof-of-consent=%22+style%3Danimation-name%3Ashine+onanimationstart%3Dalert%281%29+x%3D...

PT-2022-9621

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed WordPress plugin versions prior to 4.1.1 Description The issue is related to a reflected XSS in the custom-facebook-feed on the cff-top admin page. Recommendations For versions prior to 4.1.1, update to version...

PT-2022-9623

Name of the Vulnerable Software and Affected Versions Landing Page Builder WordPress plugin versions prior to 1.4.9.6 Description The issue is related to a reflected XSS in the page-builder-add functionality on the ulpb post admin page. Recommendations For versions prior to 1.4.9.6, update to...

CVE-2021-25067: Improper Neutralization of Input During Web Page Generation

The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpbpost admin page...

CVE-2021-25051

The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...

CVE-2021-25047

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...

Cross site scripting

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...

CVE-2021-25047

CVE-2021-25047 – 10Web Social Photo Feed Plugin : WordPress plugin versions before 1.4.29 are vulnerable to a reflected Cross-Site Scripting (XSS) on the wdi_apply_changes admin page, enabling an attacker to execute JavaScript in the context of any logged-in user. Root cause cited: lack of data v...

All-in-one Floating Contact Form < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin was vulnerable to reflected XSS on the my-sticky-elements-leads admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=my-sticky-elements-leads&search-contact;=xxxx%22%3E%3Cimg+src+onerror%3Dalert%281%29+x...

Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=woost&tab=%3Cimg+src+onerror%3Dalert%281%29%3E...

Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=woost=%3Cimg+src+onerror%3Dalert%281%29%3E...

WordPress plugin跨站请求伪造漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The WordPress Modal Window plugin was vulnerable to cross-site request forgery prior to 5.2.2. The vulnerability stems from the plugin's failure to effectively filter calls to remote file resources...

PT-2022-7041

Name of the Vulnerable Software and Affected Versions WooCommerce Stored Exporter WordPress plugin versions prior to 2.7.1 Description The issue is related to a Reflected Cross-Site Scripting XSS vulnerability in the woo ce admin page, which occurs due to insufficient neutralization of special...

PT-2022-9603

Name of the Vulnerable Software and Affected Versions 10Web Social Photo Feed WordPress plugin versions prior to 1.4.29 Description The issue is related to a reflected Cross-Site Scripting XSS vulnerability in the wdi apply changes admin page. This allows an attacker to perform an XSS attack...

PT-2022-9635

Name of the Vulnerable Software and Affected Versions Contact Form Entries WordPress plugin versions prior to 1.2.4 Description The issue concerns the Contact Form Entries WordPress plugin, which does not properly sanitise and escape various parameters, including form id, status, end date, order,...

CVE-2021-24963

The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-24963

The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the bookingtype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2021-24963: Improper Neutralization of Input During Web Page Generation

The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qcres parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting...