PT-2023-31921 · WordPress · Amp+ Plus

Name of the Vulnerable Software and Affected Versions: AMP+ Plus WordPress plugin versions 3.0 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Th...

Debug Log Manager < 2.2.2 - Debug Log Clearing via CSRF

Description The plugin does not have CSRF checks when clearing debug logs, which could allow attackers to make logged in admins perform such action via a CSRF attack...

MyBookTable Bookstore < 3.3.5 - API Key Update via CSRF

Description The plugin does not have CSRF check when updating its API key via the mbtapikeyrefreshajax function, which could allow attackers to make logged in admins update it via a CSRF attack...

PT-2023-32239 · WordPress · Wassup Real Time Analytics

Name of the Vulnerable Software and Affected Versions: WassUp Real Time Analytics WordPress plugin versions 1.9.4.5 and earlier Description: The issue allows unauthenticated users to perform Stored XSS attacks against logged in admins. This is due to the plugin not escaping IP address provided vi...

DeepL Pro API translation < 2.4.1.2 - Log Pruning via CSRF

Description The plugin does not have CSRF checks when pruning logs, which could allow attackers to make logged in admins perform such action via a CSRF attack...

Admins can change authentication details of user configured external storage

None...

CVE-2023-5609

The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Thumbnail Slider With Lightbox < 1.0.1 - Arbitrary File Upload via CSRF

Description The plugin does not have CSRF check in the addedit feature, which could allow attackers to make logged in admins upload arbitrary files via a CSRF attack...

ImageMapper <= 1.2.6 - Stored XSS via CSRF

Description The plugin does not have CSRF check in its imgmapsaveareatitle function, which could allow attackers to make logged in admins update arbitrary post titles with XSS payloads via a CSRF attack...

Webpushr < 4.35.0 - LFI via CSRF

Description The plugin does not have CSRF check in its wppsavesettings function, and does not validate the menu parameter, allowing attackers to make logged in users admins perform LFI attacks via CSRF...

WP Google My Business Auto Publish < 3.8 - Multiple CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins delete transients and update post metadata via CSRF attacks...

CVE-2023-47098

A Stored Cross-Site Scripting XSS vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field...

CVE-2023-47098

A Stored Cross-Site Scripting XSS vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field...

CVE-2023-47098

A Stored Cross-Site Scripting XSS vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field...

CVE-2023-5243 Login screen manager <= 3.5.2 - Admin+ Stored XSS

The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-47098

A Stored Cross-Site Scripting XSS vulnerability in the Manage Extra Admins under Administration Options in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the real name or description field...

Advanced Menu Widget <= 0.4.1 - Contributor+ Stored XSS via Shortcode

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admi...

WP Font Awesome <= 1.7.9 - Contributor+ Stored Cross-Site Scripting via Shortcode

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admi...

BSK PDF Manager < 3.4.2 - Contributor+ Stored XSS via Shortcode

Description The plugin does not validate and escape some of its attributes for the bsk-pdfm-category-dropdown shortcode before outputting them back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used agains...

BIT-2023-4822

Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor...