PT-2020-19211

Name of the Vulnerable Software and Affected Versions Login by Auth0 plugin versions prior to 4.0.0 Description The issue allows stored XSS on multiple pages. Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue...

PT-2020-18451

Name of the Vulnerable Software and Affected Versions Auth0 plugin for WordPress versions prior to 4.0.0 Description A stored cross-site scripting XSS issue exists in the Auth0 plugin for WordPress via the settings page. This allows for malicious scripts to be stored and executed, potentially...

PT-2020-19866

Name of the Vulnerable Software and Affected Versions Login by Auth0 plugin for WordPress versions prior to 4.0.0 Description The issue arises from the plugin's failure to sanitize and validate data from various sources before exporting user data. This oversight can lead to CSV injection attacks ...

PT-2020-18450

Name of the Vulnerable Software and Affected Versions Auth0 plugin for WordPress versions prior to 4.0.0 Description The issue is related to cross-site request forgery CSRF vulnerabilities. These vulnerabilities exist in the Auth0 plugin for WordPress, specifically via the domain field...

CVE-2020-7948: Undefined Security Weakness

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference...

PT-2020-19867

Name of the Vulnerable Software and Affected Versions Login by Auth0 plugin versions prior to 4.0.0 for WordPress Description An issue was discovered that allows a user to perform an insecure direct object reference. Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to...

WordPress Auth0 wp-auth0 Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Auth0 wp-auth0. The vulnerability stems from the WEB application...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

Design/Logic Flaw

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20173

CVE-2019-20173 pertains to the WordPress Auth0 wp-auth0 plugin (versions 3.11.x up to before 3.11.3). The issue is a cross-site scripting (XSS) vulnerability triggered through a wle parameter processed in wp-login.php, allowing unauthenticated or user-interaction-requiring execution of script in ...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

PT-2020-10357

Name of the Vulnerable Software and Affected Versions Auth0 wp-auth0 plugin versions 3.11.x through 3.11.2 Description The issue allows for XSS via a wle parameter associated with the "wp-login.php" endpoint. This affects the Auth0 wp-auth0 plugin for WordPress. Recommendations For Auth0 wp-auth0...

CVE-2019-20173: Improper Neutralization of Input During Web Page Generation

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

Cross site scripting

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock prior to version 11.21.0 is vulnerable to cross-site scripting when additionalSignUpFields uses an untrusted placeholder. The issue is triggered by untrusted placeholder content being rendered in the Sign Up dialog, enabling XSS. Red Hat and OSV records corroborate the same description...