747 matches found
CVE-2021-25096
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL...
CVE-2021-25095
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2locationcountryblockersaverules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing...
CVE-2021-25095
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2locationcountryblockersaverules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing...
Cross site request forgery (csrf)
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2locationcountryblockersaverules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend...
Cross site request forgery (csrf)
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2locationcountryblockersaverules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing...
Design/Logic Flaw
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL...
CVE-2021-25108
CVE-2021-25108 affects the WordPress IP2Location Country Blocker plugin (versions before 2.26.6). The root cause is missing CSRF protection in the ip2location_country_blocker_save_rules AJAX action, enabling an attacker with logged-in admin privileges to ban a specific country or all countries, b...
CVE-2021-25108 IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2locationcountryblockersaverules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend...
CVE-2021-25096
The CVE-2021-25096 affects the WordPress plugin IP2Location Country Blocker prior to version 2.26.5 . The vulnerability enables a ban bypass by supplying a specific parameter in the URL (e.g., examples like ?admin-ajax=hehe). This is a URL-parameter-based bypass that undermines access controls wi...
CVE-2021-25096 IP2Location Country Blocker < 2.26.5 - Ban Bypass
The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL...
Wordpress Plugin IP2Location Country Blocker 访问控制错误漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. An access control error vulnerability exists in th...
CVE-2021-25095
The CVE describes a authorization/CSRF flaw in the WordPress plugin IP2Location Country Blocker, versions prior to 2.26.5. The ip2location_country_blocker_save_rules AJAX action lacks proper checks, allowing any authenticated user (e.g., a subscriber) to block arbitrary countries or all countries...
Wordpress Plugin IP2Location Country Blocker 访问控制错误漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. An Access Control Error vulnerability exists in the Wordpress...
Wordpress Plugin IP2Location Country Blocker 跨站请求伪造漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site request forgery vulnerability exists in the...
WordPress IP2Location Country Blocker 2.26.7 Plugin - Stored Cross Site Scripting Vulnerability
Exploit Title: WordPress Plugin IP2Location Country Blocker 2.26.7 - Stored Cross Site Scripting XSS Authenticated Exploit Author: Ahmet Serkan Ari Software Link: https://wordpress.org/plugins/ip2location-country-blocker/ Version: 2.26.7 Tested on: Linux CVE: N/A Thanks: Ceylan Bozogullarindan...
WordPress Plugin IP2Location Country Blocker 2.26.7 - Stored Cross Site Scripting (XSS) (Authenticated)
Exploit Title: WordPress Plugin IP2Location Country Blocker 2.26.7 - Stored Cross Site Scripting XSS Authenticated Date: 02-02-2022 Exploit Author: Ahmet Serkan Ari Software Link: https://wordpress.org/plugins/ip2location-country-blocker/ Version: 2.26.7 Tested on: Linux CVE: N/A Thanks: Ceylan...
IP2Location Country Blocker < 2.26.9 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC As admin, enable Frontend Blocking and put the following payload in the Display page when visitor is block...
WordPress IP2Location Country Blocker 2.26.7 Cross Site Scripting
Exploit Title: WordPress Plugin IP2Location Country Blocker 2.26.7 - Stored Cross Site Scripting XSS Authenticated Date: 02-02-2022 Exploit Author: Ahmet Serkan Ari Software Link: https://wordpress.org/plugins/ip2location-country-blocker/ Version: 2.26.7 Tested on: Linux CVE: N/A Thanks: Ceylan...
IP2Location Country Blocker < 2.26.9 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. As admin, enable Frontend Blocking and put the following payload in the Display page when visitor is blocked U...