PT-2023-23141

Name of the Vulnerable Software and Affected Versions Chris Roberts Tippy plugin versions = 6.2.1 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher authentication levels. There is no information provided about the...

CVE-2023-30778: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin = 10.0.1 versions...

CVE-2023-4283: Improper Neutralization of Input During Web Page Generation

The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpresscalendar' shortcode in versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2023-23826: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Arsham Mirshah Add Posts to Pages plugin = 1.4.1 versions...

CVE-2023-23798: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Muneeb Layer Slider plugin = 1.1.9.7 versions...

CVE-2023-37983: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Noël Jackson Art Direction plugin = 0.2.4 versions...

CVE-2023-23828: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Swashata WP Category Post List Widget plugin = 2.0.3 versions...

CVE-2023-29099: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Elegant themes Divi theme = 4.20.2 versions...

CVE-2023-23877: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in bkmacdaddy designs Pinterest RSS Widget plugin = 2.3.1 versions...

CVE-2023-23880: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in ExactMetrics plugin = 7.14.1 versions...

CVE-2022-45821: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in NooTheme Noo Timetable plugin = 2.1.3 versions...

CVE-2023-36503: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Max Foundry WordPress Button Plugin MaxButtons plugin = 9.5.3 versions...

CVE-2023-23833: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Cross-Site Scripting XSS vulnerability in Steven Henty Drop Shadow Boxes plugin = 1.7.10 versions...

CVE-2023-2433

The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in page...

CVE-2023-2433 YARPP – Yet Another Related Posts Plugin <= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in page...

CVE-2023-2433: Improper Neutralization of Input During Web Page Generation

The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in page...

CVE-2023-29435: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Zwaply Cryptocurrency All-in-One plugin = 3.0.19 versions...

CVE-2023-29436: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Flyn San IFrame Shortcode plugin = 1.0.5 versions...

CVE-2023-3387: Improper Neutralization of Input During Web Page Generation

The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lanatexttoimage' and 'lanatexttoimg' shortcode in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2023-27629: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Paul Ryley Site Reviews plugin = 6.5.1 versions...