CVE-2023-0583 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updatevkblocksoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons...

CVE-2023-0583

The CVE-2023-0583 entry concerns the VK Blocks plugin for WordPress. Affected component: REST endpoint for updating settings (update_vk_blocks_options). Root cause: improper authorization enabling attackers with contributor-level permissions or higher to change plugin settings, including default ...

CVE-2023-0583 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updatevkblocksoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons...

WordPress plugin VK Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin VK Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-16383 · WordPress · Vk Blocks

Name of the Vulnerable Software and Affected Versions: VK Blocks plugin for WordPress versions up to, and including, 1.57.0.5 Description: The issue concerns improper authorization via the REST update options function. This allows authenticated attackers with contributor-level permissions or abov...

PT-2023-16382 · WordPress · Vk Blocks

Name of the Vulnerable Software and Affected Versions: VK Blocks plugin for WordPress versions up to, and including, 1.57.0.5 Description: The issue concerns improper authorization via the REST update vk blocks options function. This allows authenticated attackers with contributor-level permissio...

CVE-2023-0584: Improper Authorization

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updateoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vkfontawesomeversion' option to an arbitrar...

CVE-2023-0583: Improper Authorization

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updatevkblocksoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons...

VK Blocks < 1.57.1.0 - Contributor+ Settings Update via REST API

The plugin uses improper authorization for the REST API vk-blocks/v1/updatevkblocksoptions, allowing users with a role as low as contributor to change plugin settings including default icons...

VK Blocks < 1.58.0.0 - Contributor+ Settings Update via REST API

The plugin uses improper authorization for the REST API vk-blocks/v1/options/vkfontawesomeversion, allowing users with a role as low as contributor to change the vkfontawesomeversion option to an arbitrary value...

CVE-2023-33964 mx-chain-go does not treat invalid transaction with wrong username correctly

mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor...

DRUPAL-CONTRIB-2023-019

This module provides social media share & follow buttons. The module doesn't sufficiently restrict AddToAny block settings to users who have permission to administer AddToAny. This allows users with lower permission to configure malicious code leading to a Cross Site Scripting XSS vulnerability...

DRUPAL-CONTRIB-2023-016

The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting XSS vulnerability. Th...

Iubenda Integration - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-016

The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting XSS vulnerability. Th...

Consent Popup - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-017

The Consent Popup provides a configurable popup that requires acceptance of a question before the visitor can continue, typically used for age consent. The module doesn't sufficiently sanitizes the text on the block leading to a cross site scripting XSS vulnerability. This vulnerability is...

CVE-2023-33212

Cross-Site Request Forgery CSRF vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin = 3.0.6 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin = 3.0.6 versions...

CVE-2023-33212

CVE-2023-33212 : Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin with version &lt;= 3.0.6 contains a CSRF vulnerability (unauthenticated). The issue is mitigated by upgrading to version 3.0.7 or later. Multiple sources confirm the vulnerability details and patch, e.g., PatchStack n...

WordPress plugin JetFormBuilder — Dynamic Blocks Form Builder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...