CVE-2022-3909

The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3249

The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQL injection attacks...

Contest Gallery < 19.1.5 - Admin+ SQL Injection

The plugins do not escape the wpuserid GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges i.e. on multisite WordPress configurations to leak sensitive information from the site's database. PoC Exploit 1:...

PT-2022-24392 · WordPress · Uji Countdown

Name of the Vulnerable Software and Affected Versions: Uji Countdown WordPress plugin versions prior to 2.3.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in...

PT-2022-26296 · WordPress · Chained Quiz

Name of the Vulnerable Software and Affected Versions: Chained Quiz plugin for WordPress versions up to, and including, 1.3.2.2 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrative privileges to inject arbitra...

CVE-2022-3824

The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3490 Checkout Field Editor for WooCommerce < 1.8.0 - Admin+ PHP Object Injection

The Checkout Field Editor Checkout Manager for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

WordPress plugin Video Thumbnails 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

GHSA-G8JW-8VPV-PV5Q Cross-site Scripting in Backdrop CMS

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. The account must have admin privileges...

Cross-site Scripting in Backdrop CMS

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. The account must have admin privileges...

Cross-Site Scripting (XSS)

ezsystems/ezplatform-admin-ui is vulnerable to cross-site scripting. The vulnerability exists because the admin privileges are not properly handled when editing content types which allows an attacker to inject and execute malicious javascript in the content type entries...

CVE-2022-3753

The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup...

CVE-2022-3618

The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup...

CVE-2022-3618

The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup...

CVE-2022-41611

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application...

Cross site scripting

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application...

CVE-2022-41611 Potential XSS on sidebar navigation

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application...

CVE-2022-41611 Potential XSS on sidebar navigation

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application...

CVE-2022-41611

BlueSpice CVE-2022-41611 affects the BlueSpiceDiscovery skin. An XSS flaw allows a user with admin privileges to inject arbitrary HTML into the main navigation of the application. The issue is centered on the skin’s rendering logic (BlueSpiceDiscovery) and is not described as fixed in the provide...

PT-2022-25985 · Bluespice · Bluespice

Name of the Vulnerable Software and Affected Versions: BlueSpice affected versions not specified Description: The issue allows a user with admin privileges to inject arbitrary HTML into the main navigation of the application, which is a result of a Cross-site Scripting XSS vulnerability in the...