Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PluginOps Landing Page Builder plugin = 1.5.1.2 versions...

CVE-2023-40675 WordPress Landing Page Builder Plugin <= 1.5.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PluginOps Landing Page Builder plugin = 1.5.1.2 versions...

CVE-2023-40675 WordPress Landing Page Builder Plugin <= 1.5.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PluginOps Landing Page Builder plugin = 1.5.1.2 versions...

CVE-2023-40675

CVE-2023-40675 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the PluginOps Landing Page Builder plugin for WordPress, affecting versions up to 1.5.1.2. The vulnerability requires authentication with admin+ privileges and is classified as a stored XSS issue (no explicit exploit de...

WordPress plugin Landing Page Builder - Lead Page - Optin Page - Squeeze Page - WordPress Landing Pages Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Landing Page Builder < 1.5.1.3 - Admin+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2023-27593 · Unknown · Pluginops Landing Page Builder

Name of the Vulnerable Software and Affected Versions: PluginOps Landing Page Builder plugin versions 1.5.1.2 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For PluginOps Landin...

WordPress plugin WP VR - 360 Panorama and Virtual Tour Builder For WordPress Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WP VR - 360 Panorama...

WordPress Popup Builder Plugin < 4.2.0 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sygnoos:popupbuilder"; if description...

WordPress Popup Builder Plugin < 4.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Popup Builder Type Plugin Vulnerable versions 4.2.2 Fixed in 4.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3226 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3861c79d8ad1 Credits Dipak Panchal th3.d1pak...

CVE-2023-3226

The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3226

The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3226

CVE-2023-3226 affects the Popup Builder WordPress plugin, prior to version 4.2.0. The issue arises from insufficient sanitization/escaping of several settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (multisite contexts)...

CVE-2023-3226 Popup Builder < 4.2.0 - Admin+ Stored Cross-Site Scripting

The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PageLayer < 1.7.8 - Author+ Stored XSS

Description The plugin doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code. - As a user with Author+ capabilities, create a new post draft - Save it, then edit it using the PageLayer page builder - Navigate to the...

WordPress plugin Popup Builder cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress iPanorama 360 WordPress Virtual Tour Builder Plugin < 1.8.0 is vulnerable to SQL Injection

Software iPanorama 360 WordPress Virtual Tour Builder Type Plugin Vulnerable versions 1.8.0 Fixed in 1.8.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID fc24718ff856 Credits Unknown Required privilege...

PageLayer < 1.7.8 - Author+ Stored XSS

Description The plugin doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code. PoC - As a user with Author+ capabilities, create a new post draft - Save it, then edit it using the PageLayer page builder - Navigate to...

PageLayer < 1.7.7 - Unauthenticated Stored XSS

Description The plugin doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts. PoC Unauthenticated attacker Proof of Concept 1 As a legitimate administrator, schedule a post to be published in a few minutes. 2 Close every window to that site to...

PT-2023-23685 · WordPress · Popup Builder

Name of the Vulnerable Software and Affected Versions: Popup Builder WordPress plugin versions prior to 4.2.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed,...