7273 matches found
CVE-2023-23891
The CVE-2023-23891 entry concerns the WordPress Ocean Extra plugin (OceanWP) with a Stored XSS vulnerability in versions ≤ 2.1.1 when the OceanWP theme is installed and activated. The root cause is an input handling/shortcode context that permits script injection by authenticated contributors. Af...
CVE-2023-24374 WordPress Material Design Icons for Page Builders Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Photon WP Material Design Icons for Page Builders plugin = 1.4.2 versions...
CVE-2023-24387
WPdevart Organization chart plugin for WordPress is affected in versions
CVE-2023-24403
The CVE-2023-24403 entry describes a Stored XSS vulnerability in the WordPress bbPress Voting plugin (WP For The Win) versions
CVE-2023-24383
The CVE-2023-24383 entry affects the Kiboko Labs Namaste! LMS WordPress plugin (versions ≤ 2.5.9.1). The issue is a Stored Cross-Site Scripting (XSS) vulnerability that requires admin+ authentication to exploit. The root cause involves insufficient input handling/escaping in the plugin, enabling ...
Cross site scripting
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Timersys WP Popups – WordPress Popup plugin = 2.1.4.8 versions...
CVE-2023-24003
CVE-2023-24003 affects the WP Popups WordPress plugin, specifically versions
CVE-2023-24002
CVE-2023-24002 affects the WordPress plugin YouTube Embed, Playlist and Popup by WpDevArt, specifically versions up to 2.6.3. The vulnerability is an authenticated (admin+) Stored XSS in the plugin. Root cause details are not expanded beyond the description, but the issue is mitigated by upgradin...
CVE-2023-24002 WordPress YouTube Embed, Playlist and Popup by WpDevArt Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin = 2.6.3 versions...
CVE-2023-24006
The CVE-2023-24006 entry affects the WordPress plugin Link Software LLC WP Terms Popup, vulnerable in versions
CVE-2023-23998 WordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin = 1.3.0 versions...
CVE-2023-23998 WordPress VikRentCar Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin = 1.3.0 versions...
CVE-2023-23980
MailOptin Popup Builder WordPress plugin
CVE-2023-23972
CVE-2023-23972 concerns the WordPress plugin “Social Like Box and Page by WpDevArt” (Smplug-in) up to version 0.8.39. The issue is a stored XSS vulnerability that requires admin+ privileges to exploit. The underlying cause is improper sanitization/escaping in the plugin’s inputs, enabling a high-...
CVE-2023-23815
CVE-2023-23815 affects the WordPress plugin WordPress Multi-column Tag Map (Alan Jackson) versions
POLR URL 2.3.0 - Shortener Admin Takeover
Exploit Title: POLR URL 2.3.0 - Shortener Admin Takeover Date: 2021-02-01 Exploit Author: p4kl0nc4t Vendor Homepage: - Software Link: https://github.com/cydrobolt/polr Version: 2.3.0 Tested on: Linux CVE : CVE-2021-21276 import json import requests payload = 'acctusername': 'admin', 'acctpassword...
CVE-2023-26536
CVE-2023-26536 affects the WordPress plugin “Jonk @ Follow me Darling Sptify Play Button for WordPress” (Sp tify Play Button) up to version 2.05. The issue is an authenticated stored XSS via shortcode attributes (contributor+ required) that can output malicious scripts. Patch available in version...
ILIAS < 7.19 Multiple Vulnerabilities
ILIAS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ilias:ilias"; if description...
CVE-2023-23977 WordPress Heateor Social Comments Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments plugin = 1.6.1 versions...