2732 matches found
WordPress Flat UI Button Plugin 1.0 is vulnerable to Cross Site Scripting (XSS)
Software Flat UI Button Type Plugin Vulnerable versions 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10014 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 35d97ede67c1 Credits Francesco Carlucci Required...
WordPress plugin Custom Add to Cart Button Label and Link 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...
WordPress Custom Add to Cart Button Label and Link plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Custom Add to Cart Button Label and Link versions = 1.6.1...
WordPress Read more By Adam plugin <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Read More Button Deletion vulnerability discovered by Francesco Carlucci in WordPress Plugin Read more By Adam versions = 1.1.8...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation of the vector-toc-toggle-button-label parameter. Remediation A fix was pushed into the master branch but not yet published. References - Gerrit Wikimedia - GitHub Commit - Wikimedia Phabricator...
DEBIAN-CVE-2023-45359
An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup...
UBUNTU-CVE-2023-45359
An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup...
CVE-2024-44018 WordPress Instant Chat WP plugin <= 1.0.5 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in istmoplugins Instant Chat Floating Button for WordPress Websites instant-chat-wp allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through =...
WordPress plugin Instant Chat Floating Button for WordPress Websites 路径遍历漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...
CVE-2024-8505
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttonlabel’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
WordPress Ajax Load More plugin <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via buttonlabel Parameter vulnerability discovered by Robert DeVore in WordPress Plugin Ajax Load More versions = 7.1.2...
WordPress plugin WordPress Infinite Scroll 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...
PT-2024-39200 · WordPress · Rumbletalk Live Group Chat
Name of the Vulnerable Software and Affected Versions: RumbleTalk Live Group Chat – HTML5 plugin for WordPress versions up to, and including, 6.3.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'rumbletalk-admin-button' shortcode due to insufficient input...
WordPress plugin RumbleTalk Live Group Chat 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...
CVE-2024-9049
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group module in all versions up to, and including, 2.8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-9049 Beaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button Group module in all versions up to, and including, 2.8.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-9049
CVE-2024-9049 — Beaver Builder for WordPress: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via the Button Group Module in versions up to 2.8.3.6. Root cause: insufficient input sanitization and output escaping on user-supplied attributes in the Button Group. Impact: stored X...
WordPress Beaver Builder plugin <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module vulnerability
Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Button Group Module vulnerability discovered by zer0gh0st in WordPress Plugin Beaver Builder versions = 2.8.3.6...
PT-2024-39390 · WordPress · The Beaver Builder
Name of the Vulnerable Software and Affected Versions: The Beaver Builder – WordPress Page Builder plugin versions up to, and including, 2.8.3.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Button Group module due to insufficient input sanitization and output...