44 matches found
CVE-2022-1203
CVE-2022-1203 Content Mask 1.8.4 - 購読者+ 任意オプション更新 説明 Content Mask WordPressプラグインの1.8.4.1より前のバージョンには、さまざまなAJAXアクションにおいて認可チェックとCSRFチェックがなく、また、更新されるオプションがプラグインに属していることを検証しません。その結果、購読者などの認証済みユーザーがブログの任意のオプションを変更できる可能性があります。 使用方法 エクスプロイト root@kitploit: $ python3 CVE-2022-1203.py -u http://wordpress.la...
CVE-2025-15690
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
CVE-2025-15690 Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
EUVD-2025-210873
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
WordPress Content Mask plugin 1.7.1-1.8.5.5 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Andrea Fiocchi in WordPress Plugin Content Mask versions 1.7.1-1.8.5.5...
CVE-2025-15690
CVE-2025-15690 is a Stored Cross-Site Scripting (XSS) vulnerability in the Content Mask WordPress plugin, affecting versions 1.7.1 through 1.8.5.5 . The root cause is improper sanitization and escaping of post content—specifically scripts and styles submitted by an author—before being output in g...
CVE-2025-15690 Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
CVE-2026-77003
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
EUVD-2026-64637
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
CVE-2026-77003
The Content Mask WordPress plugin (versions 1.8.0 through 1.8.5.4 ) contains a privilege escalation vulnerability in the create_new_content_mask function. The plugin fails to verify the required capability before publishing the post type being created, allowing users with the Contributor role to ...
PT-2026-79761
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
EUVD-2025-30605
Malicious code in bioql PyPI...
EUVD-2025-30631
Malicious code in bioql PyPI...
EUVD-2022-24543
Malicious code in bioql PyPI...
CVE-2025-58012
Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Mask: from n/a through = 1.8.5.3...
CVE-2025-58011
Server-Side Request Forgery SSRF vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through = 1.8.5.2...
CVE-2025-58012
Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Mask: from n/a through = 1.8.5.3...