PT-2023-15428 · WordPress · Wp-Cors

Name of the Vulnerable Software and Affected Versions: Tim Stephenson WP-CORS plugin versions 0.2.1 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Tim Stephenson WP-CORS...

PT-2023-19281 · WordPress · Kanban For Wordpress

Name of the Vulnerable Software and Affected Versions: Kanban for WordPress Kanban Boards for WordPress plugin versions = 2.5.20 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin privileges can inject...

PT-2023-21604 · Corefortress · Corefortress Easy Event Calendar Plugin

Name of the Vulnerable Software and Affected Versions: CoreFortress Easy Event calendar plugin versions prior to 1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 1.0...

PT-2023-19899 · Teplitsa · Teplitsa Yandex.News Feed

Name of the Vulnerable Software and Affected Versions: Teplitsa Yandex.News Feed by Teplitsa plugin versions 1.12.5 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions...

PT-2023-20424 · WordPress · Denzel Chia | Phire Design Custom Login Page

Name of the Vulnerable Software and Affected Versions: Denzel Chia | Phire Design Custom Login Page plugin versions = 2.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Denzel Chia |...

PT-2023-20300 · WordPress · Alex Moss Firecask Like & Share Button

Name of the Vulnerable Software and Affected Versions: Alex Moss FireCask Like & Share Button plugin versions 1.1.5 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Alex Moss...

PT-2023-20429 · WordPress · Blueglass Jobs For Wordpress

Name of the Vulnerable Software and Affected Versions: BlueGlass Jobs for WordPress plugin versions = 2.5.10.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For BlueGlass Jobs for WordPres...

PT-2023-19279 · Greentreelabs · Greentreelabs Circles Gallery Plugin

Name of the Vulnerable Software and Affected Versions: GreenTreeLabs Circles Gallery plugin versions 1.0.10 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For GreenTreeLabs...

PT-2023-19223 · Unknown · Moris Dov Stock Market Charts From Finviz

Name of the Vulnerable Software and Affected Versions: Moris Dov Stock market charts from finviz plugin versions = 1.0.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Moris Dov Stock...

CVE-2023-1554

The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-1525

The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Loginizer 1.7.8 - Reflected XSS

The plugin does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page with the code below...

CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

CVE-2022-41398

The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information...

PT-2023-20079 · WordPress · Wp-Insert

Name of the Vulnerable Software and Affected Versions: namithjawahar Wp-Insert plugin versions = 2.5.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions = 2.5.0, update to a versi...

PT-2023-15430 · Fullworks · Fullworks Quick Contact Form

Name of the Vulnerable Software and Affected Versions: Fullworks Quick Contact Form plugin versions = 8.0.3.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions = 8.0.3.1, update t...

PT-2023-20103 · WordPress · Oliver Schlöbe Simple Yearly Archive

Name of the Vulnerable Software and Affected Versions: Oliver Schlöbe Simple Yearly Archive plugin versions = 2.1.8 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Oliver Schlöbe Simple...

PT-2023-20097 · Podlove · Podlove Subscribe Button

Name of the Vulnerable Software and Affected Versions: Podlove Podlove Subscribe button plugin versions 1.3.7 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions 1.3.7 a...

PT-2023-19344 · Unknown · Tinymce Custom Styles Plugin

Name of the Vulnerable Software and Affected Versions: Tim Reeves & David Stöckl TinyMCE Custom Styles plugin versions = 1.1.2 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the T...