PT-2023-19896 · WordPress · Implecode Ecommerce Product Catalog Plugin

Name of the Vulnerable Software and Affected Versions: impleCode eCommerce Product Catalog Plugin for WordPress versions = 3.3.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the impleCode eCommerce Product Catalog Plugin for WordPress. This...

PT-2023-19877 · Kiboko · Kiboko Labs Chained Quiz Plugin

Name of the Vulnerable Software and Affected Versions: Kiboko Labs Chained Quiz plugin versions prior to 1.3.2.6 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to 1.3.2.6...

PT-2023-19214 · Leonardo Giacone · Easy Panorama

Name of the Vulnerable Software and Affected Versions: Leonardo Giacone Easy Panorama plugin versions = 1.1.4 Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability allows an attacker to inject...

PT-2023-20082 · Unknown · Streamweasels Twitch Player

Name of the Vulnerable Software and Affected Versions: StreamWeasels Twitch Player plugin versions = 2.1.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions = 2.1.0, at the moment...

PT-2023-20269 · Unknown · Gqevu6Bsiz Announce From The Dashboard

Name of the Vulnerable Software and Affected Versions: gqevu6bsiz Announce from the Dashboard plugin versions = 1.5.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts into the website, which can...

PT-2023-20064 · Unknown · Marcel Pol Zeno Font Resizer

Name of the Vulnerable Software and Affected Versions: Marcel Pol Zeno Font Resizer plugin versions = 1.7.9 Description: The issue is related to a Stored Cross-site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For versions = 1.7....

CVE-2023-1913

The Maps Widget for Google Maps for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in versions up to, and including, 4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission...

CVE-2023-24387

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPdevart Organization chart plugin = 1.4.4 versions...

PT-2023-19336 · WordPress · Wpgear.Pro Wpfrom Email

Name of the Vulnerable Software and Affected Versions: WPGear.Pro WPFrom Email plugin versions 1.8.8 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the WPGear.Pro WPFrom Email plugin. This vulnerability requires authentication with...

PT-2023-19557 · WordPress · Vikbooking Hotel Booking Engine & Pms

Name of the Vulnerable Software and Affected Versions: VikBooking Hotel Booking Engine & PMS plugin versions = 1.5.11 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects the VikBooking Hotel Booking Engine & PMS plugin. This vulnerability requires...

PT-2023-19351 · Unknown · Yannick Lefebvre Modal Dialog

Name of the Vulnerable Software and Affected Versions: Yannick Lefebvre Modal Dialog plugin versions = 3.5.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Yannick Lefebvre Modal Dialog...

CVE-2023-1869

The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and...

PhotoShow 3.0 - Remote Code Execution Exploit

Exploit Title: PhotoShow 3.0 - Remote Code Execution Date: January 11, 2023 Exploit Author: LSCP Responsible Disclosure Lab Detailed Bug Description: https://lscp.llc/index.php/2021/07/19/how-white-box-hacking-works-remote-code-execution-and-stored-xss-in-photoshow-3-0/ Vendor Homepage:...

PT-2023-16643 · Bhima · Bhima

Name of the Vulnerable Software and Affected Versions: Bhima version 1.27.0 Description: The issue allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator. This is possible because the application is vulnerable t...

PhotoShow 3.0 Remote Code Execution

Exploit Title: PhotoShow 3.0 - Remote Code Execution Date: January 11, 2023 Exploit Author: LSCP Responsible Disclosure Lab Detailed Bug Description: https://lscp.llc/index.php/2021/07/19/how-white-box-hacking-works-remote-code-execution-and-stored-xss-in-photoshow-3-0/ Vendor Homepage:...

PT-2023-19234 · WordPress · Marcin Pietrzak Interactive Polish Map

Name of the Vulnerable Software and Affected Versions: Marcin Pietrzak Interactive Polish Map plugin versions 1.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the...

CVE-2020-21060

PHPMyWind 5.6 is affected by a SQL injection vulnerability in the administrator management page’s delete function, allowing remote attackers with low privileges to gain elevated access. Root cause: improper input handling in the delete operation enables arbitrary SQL execution, leading to potenti...

CVE-2023-1124

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks...

Design/Logic Flaw

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks...

CVE-2023-1124 Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks...