CVE-2024-11450: Improper Neutralization of Input During Web Page Generation

The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

PT-2024-17002 · WordPress · Onlyoffice Docs

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs plugin for WordPress versions up to, and including, 2.0.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode due to insufficient input sanitization and output escaping on...

WordPress BasePress Docs plugin <= 2.16.3.3 - Missing Authorization to Authenticated (Subscriber+) Database Update vulnerability

Missing Authorization to Authenticated Subscriber+ Database Update vulnerability discovered by BrokenAC ignore in WordPress Plugin Knowledge Base documentation & wiki plugin – BasePress versions = 2.16.3.3...

CVE-2024-9207

The BuddyPress Docs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2024-39490

Name of the Vulnerable Software and Affected Versions BuddyPress Docs plugin for WordPress versions up to, and including, 2.2.3 Description The issue is related to Reflected Cross-Site Scripting due to the use of remove query arg without appropriate escaping on the URL. This allows unauthenticate...

CVE-2023-32106

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Fahad Mahmood WP Docs plugin = 1.9.9 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Fahad Mahmood WP Docs plugin = 1.9.9 versions...

CVE-2023-32106 WordPress WP Docs Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Fahad Mahmood WP Docs plugin = 1.9.9 versions...

WordPress WP Docs Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)

Software WP Docs Type Plugin Vulnerable versions = 1.9.9 Fixed in 2.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32106 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6c7b1d23694a Credits Le Ngoc Anh Required...

GHSA-9WF6-88X4-6XVJ BuddyPress Docs plugin Improper Privilege Management

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions...

CVE-2017-6954

Vulnerability in BuddyPress Docs WordPress plugin (pre-1.9.3) in includes/component.php allows authenticated users to edit other users’ documents due to improper authorization. Impact is unauthorized edits of documents; CVSS base scores (4.0–4.3) indicate MEDIUM severity. Remediation: upgrade to ...

PT-2017-17421

Name of the Vulnerable Software and Affected Versions BuddyPress Docs plugin versions prior to 1.9.3 Description The issue allows authenticated users to edit documents of other users without proper permissions. This is due to a problem in the includes/component.php file of the BuddyPress Docs...