1192 matches found
Cross site scripting
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template wpbtnsavetemplate function hooked to the init action, nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a...
CVE-2021-24792 Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template wpbtnsavetemplate function hooked to the init action, nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a...
CVE-2021-24792
The CVE-2021-24792 entry concerns the WordPress plugin Shiny Buttons (versions up to 1.1.0). The connected sources consistently describe an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability resulting from missing authorization/CSRF protection when saving templates (wpbtn_save_templa...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. shiny Buttons plugin is a WordPress open source application plugin. the WordPress Shiny Buttons plugin in version 1.1.0...
PT-2021-16287
Name of the Vulnerable Software and Affected Versions: Shiny Buttons WordPress plugin versions 1.1.0 and earlier Description: The issue concerns the lack of authorization and CSRF protection when saving a template, specifically through the wpbtn save template function hooked to the init action...
CVE-2021-24792: Improper Neutralization of Input During Web Page Generation
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template wpbtnsavetemplate function hooked to the init action, nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a...
WordPress AddToAny Share Buttons Plugin < 1.7.48 XSS Vulnerability
The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
WordPress Shiny Buttons plugin <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vishal Mohan in WordPress Shiny Buttons plugin versions = 1.1.0. Solution Deactivate and delete. This plugin has been closed as of September 27, 2021 and is not available for download. This closure is temporary, pending a...
Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
The plugin does not have any authorisation and CSRF in place when saving a template wpbtnsavetemplate function hooked to the init action, nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored...
WordPress AddToAny Share Buttons Plugin Cross-Site Scripting Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress AddToAny Share Buttons plugin in versions prior t...
CVE-2021-24616
The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24616 AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site Scripting
The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24616
CVE-2021-24616 affects the WordPress AddToAny Share Buttons plugin prior to 1.7.48. The root cause is failure to escape the Image URL button setting, enabling Cross-Site Scripting (XSS) where high-privilege users could inject script, even if unfiltered_html is disallowed. Public sources (NVD, CNV...
PT-2021-16132
Name of the Vulnerable Software and Affected Versions AddToAny Share Buttons WordPress plugin versions prior to 1.7.48 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of escaping in the Image URL button setting, even when the unfiltered ht...
CVE-2021-24616: Improper Neutralization of Input During Web Page Generation
The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24570: Cross-Site Request Forgery (CSRF)
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of t...
WordPress Podcast Subscribe Buttons plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress Podcast Subscribe Buttons plugin in versions prior to 1.4.2, which stems from a lack of checksum filtering of user-supplied data and output...
CVE-2021-24743
The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS...
