Malicious code in carousel-enabledx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 129fdd32c79e17d2c02948ef3b4661dc902f2ed62dbddb80d6c47fa3be3fc238 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6318 Malicious code in stories-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af0e016dcc3c2be20f47532541a36646d620f66cf88b19318b13996b442bff9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stories-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af0e016dcc3c2be20f47532541a36646d620f66cf88b19318b13996b442bff9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1829 Malicious code in carousel-enabled (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14078087d396c3df10838c8856bf2dc76fbb271430585b0fe8a804a0a9b38a08 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in carousel-enabled (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14078087d396c3df10838c8856bf2dc76fbb271430585b0fe8a804a0a9b38a08 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1266

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress plugin Post Grid, Slider & Carousel Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Post Grid,Slider...

CVE-2022-1336

The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...

CVE-2022-1336

The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...

CVE-2022-1336

The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...

Cross site scripting

The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...

CVE-2022-1336 Carousel CK <= 1.1.0 - Admin+ Stored Cross-Site Scripting

The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...

CVE-2022-1336

CVE-2022-1336 affects the Carousel CK WordPress plugin (versions ≤ 1.1.0). The issue is due to unsanitized/uncleaned Slide descriptions, allowing stored Cross-Site Scripting (XSS) when unfiltered_html is disallowed. Exploitation requires authenticated access (high-privilege users such as admin) a...

WordPress plugin Carousel CK 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Carousel CK plugin 1.1.0 and earlier versions have a cross-site scripting vulnerability tha...

Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create a new Grid/Caroussel, in the General Settings, enable "Display Header Title" and put the...

WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.4.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fayçal CHENA in WordPress Post Grid, Slider & Carousel Ultimate plugin versions = 1.4.3. Solution Update the WordPress Post Grid, Slider & Carousel Ultimate plugin to the latest available version at least 1.5.0...

Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Create a new Grid/Caroussel, in the General Settings, enable "Display Header Title" and put the following...

GHSA-5HR6-R8H6-WH22 JetPack Exposure of Resource to Wrong Sphere

The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhgvcs that allowed the comments of non-published...

JetPack Exposure of Resource to Wrong Sphere

The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhgvcs that allowed the comments of non-published...

WordPress Carousel CK plugin <= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fayçal CHENA in WordPress Carousel CK plugin versions = 1.1.0. Solution Deactivate and delete. This plugin has been closed as of May 16, 2022 and is not available for download. This closure is temporary, pending a full revi...