Cross site scripting

The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5507 ImageMapper <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-5743 Telephone Number Linker <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Cross site scripting

The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-5659: Improper Neutralization of Input During Web Page Generation

The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2023-5709: Improper Neutralization of Special Elements used in an SQL Command

The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-4888: Improper Neutralization of Input During Web Page Generation

The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-5507: Improper Neutralization of Input During Web Page Generation

The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

PT-2023-32245

Name of the Vulnerable Software and Affected Versions SendPress Newsletters plugin for WordPress versions up to, and including, 1.22.3.31 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcodes, allowing...

CVE-2023-4842: Improper Neutralization of Input During Web Page Generation

The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'socialwarfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2023-32297

Name of the Vulnerable Software and Affected Versions Telephone Number Linker plugin for WordPress versions up to, and including, 1.2 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the telnumlink shortcode. This allows...

CVE-2023-5577: Improper Neutralization of Input During Web Page Generation

The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-5658: Improper Neutralization of Input During Web Page Generation

The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmapit' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

PT-2023-31632

Name of the Vulnerable Software and Affected Versions Ziteboard Online Whiteboard plugin for WordPress versions up to, and including, 2.9.9 Description The issue arises from insufficient input sanitization and output escaping in the ziteboard shortcode, allowing authenticated attackers with...

CVE-2023-5076: Improper Neutralization of Input During Web Page Generation

The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2023-5669: Improper Neutralization of Input During Web Page Generation

The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, and including, 0.8.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2023-30994

Name of the Vulnerable Software and Affected Versions The Simple Like Page Plugin for WordPress versions up to, and including, 1.5.1 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'sfp-page-plugin' shortcode, allowing...

CVE-2023-5703: Improper Neutralization of Input During Web Page Generation

The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2023-46783: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Bright Plugins Pre-Orders for WooCommerce plugin = 1.2.13 versions...

PT-2023-32280

Name of the Vulnerable Software and Affected Versions SEO Slider plugin for WordPress versions up to, and including, 1.1.0 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta due to insufficient input sanitization and output escaping o...