PT-2024-18483 · WordPress · Smart Custom Fields

Name of the Vulnerable Software and Affected Versions: Smart Custom Fields plugin for WordPress versions up to, and including, 4.2.2 Description: The issue arises from a missing capability check on the relational posts search function, allowing authenticated attackers with subscriber-level access...

CVE-2024-28394

The Advanced Plugins reportsstatistics module for PrestaShop (versions 1.3.20 and before ) contains a vulnerability allowing a remote attacker to achieve arbitrary code execution via the Sales Reports, Statistics, Custom Fields & Export module . To remediate this issue, users should update to a v...

CVE-2023-6880

The Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 45.6.0 due to insufficient input sanitizatio...

CVE-2023-6809

The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied custom post meta values. This makes it possible for...

CVE-2023-6809

The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied custom post meta values. This makes it possible for...

Cross site scripting

The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied custom post meta values. This makes it possible for...

CVE-2023-6809 Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied custom post meta values. This makes it possible for...

CVE-2023-6809 Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

The Custom fields shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cf shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied custom post meta values. This makes it possible for...

PT-2024-15115 · WordPress · Visual Composer Website Builder

Name of the Vulnerable Software and Affected Versions: Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin for WordPress versions up to, and including, 45.6.0 Description: The issue is related to Stored Cross-Site Scripting via...

WordPress Plugin Custom fields shortcode security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

PT-2024-15093 · WordPress · Custom Fields Shortcode Plugin

Name of the Vulnerable Software and Affected Versions: Custom fields shortcode plugin for WordPress version 0.1 and earlier Description: The issue arises from insufficient input sanitization and output escaping on user-supplied custom post meta values, allowing authenticated attackers with...

CVE-2024-25845

In the module "CD Custom Fields 4 Orders" cdcustomfields4orders = 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions...

Sql injection

In the module "CD Custom Fields 4 Orders" cdcustomfields4orders = 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions...

PrestaShop Security Breach

PrestaShop is a set of open source e-commerce solutions from PrestaShop, USA. The solution offers multiple payment methods, short message alerts and product image zoom. A security vulnerability exists in PrestaShop CD Custom Fields 4 Orders version 1.0.0 and earlier versions. An attacker exploite...

CVE-2024-25845

The CD Custom Fields 4 Orders (cdcustomfields4orders) module for PrestaShop by Cleanpresta.com is vulnerable to SQL injection in versions 1.0.0 and earlier . A guest can exploit this flaw to perform malicious actions by leveraging improper neutralization of special elements in SQL commands. To re...

CVE-2024-25845

In the module "CD Custom Fields 4 Orders" cdcustomfields4orders = 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions...

PT-2024-21157 · Unknown · Cd Custom Fields 4 Orders

Name of the Vulnerable Software and Affected Versions: CD Custom Fields 4 Orders version 1.0.0 and earlier Description: A SQL injection issue exists, allowing a guest to perform malicious actions. Recommendations: For versions 1.0.0 and earlier, update to a version later than 1.0.0 to resolve the...

Schema Pro < 2.7.16 - Contributor+ Custom Field Access

Description The plugin does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode PoC As a contributor, add/edit a post and embed aiosrsprocustomfield postid="ANYPOSTID" fieldkey="ANYMETAKEY" and specify/guess an...

CVE-2024-1277

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to...

WordPress Custom fields shortcode Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom fields shortcode Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6809 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 73516645b707 Credits Francesco Carlucci...