CVE-2020-11516

Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wpajaxcf7dpsavesettings AJAX action and the uitheme parameter. If an administrator creat...

Cross site scripting

Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wpajaxcf7dpsavesettings AJAX action and the uitheme parameter. If an administrator creat...

CVE-2020-11516

The CVE-2020-11516 entry refers to a stored XSS in the WordPress plugin “Contact Form 7 Datepicker” up to version 2.6.0. The vulnerability arises from saving settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter, enabling an authenticated user with minima...

CVE-2020-11516

Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wpajaxcf7dpsavesettings AJAX action and the uitheme parameter. If an administrator creat...

WordPress Contavt Form 7 Datepicker Plugin <= 2.6.0 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.112730";...

WordPress Contact Form 7 Datepicker plugin <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Contact Form 7 Datepicker plugin versions = 2.6.0. Solution This plugin has been closed as of April 1, 2020 and is not available for download. Reason: Security Issue...

Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS)

Contact Form 7 Datepicker registers an AJAX action to save settings which calls a function that fails to perform a capability check or nonce check. As such, a logged-in attacker with minimal permissions such as a subscriber can send a crafted request which will store a malicious JavaScript in the...

Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS)

Contact Form 7 Datepicker registers an AJAX action to save settings which calls a function that fails to perform a capability check or nonce check. As such, a logged-in attacker with minimal permissions such as a subscriber can send a crafted request which will store a malicious JavaScript in the...

Malicious Package

Overview Versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from yo...

Cross-site Scripting (XSS)

bootstrap-datepicker is vulnerable to a cross-site scripting XSS attack. The library does not properly handle the jQuery for the date container, allowing a malicious user to inject arbitrary Javascript...

CVE-2017-17828

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...

Design/Logic Flaw

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...

CVE-2017-17828

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...

CVE-2017-17828

Bus Booking Script has XSS via the results.php datepicker parameter or the admin/newmaster.php spemail parameter...

CVE-2017-17828

CVE-2017-17828 affects Bus Booking Script (PHP/MySQL). The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the results.php datepicker parameter or the admin/new_master.php spemail parameter. The connected sources confirm the same XSS description across multiple feeds; no vendor...