CVE-2023-24499 Butterfly Button plugin may leave traces of its use on user's device

Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spouse knowing about its use...

Butterfly Button 安全漏洞

Butterfly Button is an app from the individual developers of TheButterflySDK who are actively involved in the fight against domestic violence. Butterfly Button suffers from a security vulnerability that stems from the possibility of leaving traces of use on a user's device...

FireCask Like & Share Button < 1.2 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-24499

CVE-2023-24499 concerns the Butterfly Button plugin, which may leave traces of its use on a user’s device. Public data reports an impact to confidentiality (traceability of usage) with a CVSSv3.1 base score around 4.3–4.6 (medium). The vulnerability is described in terms of residual traces rather...

CVE-2023-24499 Butterfly Button plugin may leave traces of its use on user's device

Butterfly Button plugin may leave traces of its use on user's device. Since it is used for reporting domestic problems, this may lead to spouse knowing about its use...

Podlove Subscribe button < 1.3.9 - Multiple CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins perform unwanted actions such as create/update/delete buttons, as well update/create formats via CSRF attacks...

WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Podlove Subscribe button Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25481 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 87331aa50a18 Credits yuyudhn...

CVE-2022-4628

The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2022-4628 Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode

The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2022-4628 Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode

The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

WordPress plugin Easy PayPal Buy Now Button 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

Microweber Cross-Site Scripting Vulnerability (CNVD-2023-07919)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.3.2, which stems from a security issue in...

Microweber 跨站脚本漏洞

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.3.2, which stems from a security issue in...

WordPress Nice PayPal Button Lite Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Nice PayPal Button Lite Type Plugin Vulnerable versions = 1.3.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22686 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 497c643d4eec Credits Mika Required...

WordPress Easy PayPal Buy Now Button Plugin < 1.7.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy PayPal Buy Now Button Type Plugin Vulnerable versions 1.7.3 Fixed in 1.7.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d96c1118d3fb Credits WPScanTeam Required...

Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC wpecpp name="' accesskey='X'...

Nice PayPal Button Lite <= 1.3.5 - CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

WordPress GamiPress – Button Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress – Button Type Plugin Vulnerable versions = 1.0.4 Fixed in 1.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f951420d1e59 Credits N/A Required privilege...

yuko-bot 安全漏洞

yuko-bot is a simple irc button for Mangas by the individual developer Emma Florenzano. A security vulnerability exists in yuko-bot, which stems from the fact that incorrect manipulation of the parameter title can lead to a denial of service...

Stripe: XSS vulnerability without a content security bypass in a `CUSTOM` App through Button tag

A possible XSS vulnerability was discovered in a CUSTOM app through the Button tag, without being able to bypass a content security policy. An attacker could exploit this vulnerability to execute malicious code on the affected website...