WordPress Absolutely Glamorous Custom Admin Plugin <= 7.2.3 is vulnerable to Server Side Request Forgery (SSRF)

Software Absolutely Glamorous Custom Admin Type Plugin Vulnerable versions = 7.2.3 Fixed in 7.2.4 OWASP Top 10 A4: Insecure Design Classification Server Side Request Forgery SSRF CVE CVE-2024-33627 Patch priority Low CVSS severity Low 4.4 Developer Cusmin PSID aca8f3a66d97 Credits emad Required...

BIT-MATTERMOST-2022-1332

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents...

CVE-2023-52128

Cross-Site Request Forgery CSRF vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0...

CVE-2023-52128

CVE-2023-52128: CSRF vulnerability in White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard. Affected versions: from n/a through 2.9.0. The provided connected documents do not reveal exploit details, patch status, vectors, or remediation steps; technical specifics are not ...

WP Custom Admin Interface < 7.32 - Missing Authorization via wpcai_pro_notice_disable

Description The WP Custom Admin Interface plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the wpcaipronoticedisable function in versions up to, and including, 7.31. This makes it possible for authenticated attackers, with...

WP Custom Admin Interface < 7.33 - Missing Authorization to Transients Deletion

Description The WP Custom Admin Interface plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpcustomadmininterfacedeletetransients function in versions up to, and including, 7.32. This makes it possible for authenticated attackers, wi...

WordPress WP Custom Admin Interface Plugin <= 7.31 is vulnerable to Broken Access Control

Software WP Custom Admin Interface Type Plugin Vulnerable versions = 7.31 Fixed in 7.32 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47763 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 73d0182de151 Credits Abdi Pranata...

WordPress WP Custom Admin Interface Plugin <= 7.32 is vulnerable to Broken Access Control

Software WP Custom Admin Interface Type Plugin Vulnerable versions = 7.32 Fixed in 7.33 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44988 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 74d65a8c422e Credits Abdi Pranata Required...

CVE-2023-40329

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

CVE-2023-40329 WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

CVE-2023-40329

CVE-2023-40329 affects the WordPress plugin WPZest Custom Admin Login Page (WPZest) up to version 1.2.0. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw, where user input in admin settings is not properly validated/escaped, enabling XSS with admin privileges. Several ...

CVE-2023-40329 WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPZest Custom Admin Login Page | WPZest plugin = 1.2.0 versions...

WordPress plugin custom-admin-login-styler-wpzest cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Custom Admin Login Page | WPZest Type Plugin Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-40329 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1213e411287f Credits Lokesh...

LM-CUSTOM-ADMIN, , Other

Version: Old 2.7.3 / New 2.7.4 Update details: block cde php shellexec Update URL: https://lomart.fr/extensions-blog/38-modules-administrator/125-lm-custom-administrator Changelog URL:...

CVE-2022-4043

The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

CVE-2022-4043

The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

Design/Logic Flaw

The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

CVE-2022-4043

Summary: The WP Custom Admin Interface WordPress plugin is vulnerable in versions prior to 7.29 due to unserializing user input in settings, which could allow high-privilege users such as admins to perform PHP Object Injection when a suitable gadget is present. The condition is documented across ...