PT-2021-16052

Name of the Vulnerable Software and Affected Versions Alojapro Widget WordPress plugin versions 1.1.15 and earlier Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to improper sanitization of Custom CSS settings, even when the unfiltered html capabilit...

CVE-2021-24518

The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-24518

The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-24518

The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-24518 WPFront Notification Bar < 2.0.0.07176 - Authenticated Stored XSS

The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

PT-2021-16040

Name of the Vulnerable Software and Affected Versions WPFront Notification Bar WordPress plugin versions prior to 2.0.0.07176 Description The issue allows high privilege users, such as admins, to set XSS payload in the Custom CSS setting, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-24518: Improper Neutralization of Input During Web Page Generation

The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

Alojapro Widget < 1.1.16 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following code in the Custom CSS settings of the plugin setTimeout"alert'1'",3000...

WPFront Notification Bar < 2.0.0.07176 - Authenticated Stored XSS

The plugin does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue PoC v 1.9.2.07163 - Put the following payload in...

CVE-2021-24357

In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue...

CVE-2021-24357

In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue...

CVE-2021-24357 FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting

In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue...

PT-2021-15893

Name of the Vulnerable Software and Affected Versions FooGallery WordPress plugin versions prior to 2.0.35 Description The issue arises from the Custom CSS field of each gallery not being properly sanitised or validated before being output in the page where the gallery is embedded, leading to a...

CVE-2021-24357: Improper Neutralization of Input During Web Page Generation

In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue...

FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting

In the plugin, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue. PoC Create or edit a gallery and add the following payload in the Custom CSS field:...

FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting

In the plugin, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue. Create or edit a gallery and add the following payload in the Custom CSS field: Then, view t...

Cross site request forgery (csrf)

Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into...

CVE-2021-24159

CVE-2021-24159 affects the WordPress plugin “Contact Form 7 Style” up to version 3.1.9. The issue stems from a lack of sanitization and nonce protection on the plugin’s custom CSS feature, enabling a CSRF attack that can cause the CSS settings to inject malicious JavaScript into a site. Exploitat...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. Contact Form 7 Style WordPress plugin through 3.1.9 suffers from a cross-site request forgery vulnerability that ste...

CVE-2021-24159: Cross-Site Request Forgery (CSRF)

Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clickin...