CVE-2023-5229

The CVE pertains to the WordPress plugin E2Pdf (versions prior to 1.20.20). The root cause is that the plugin does not sanitize and escape certain settings, enabling stored Cross-Site Scripting by high-privilege (Administrator) users, even when unfiltered_html is disallowed. Affected: E2Pdf WordP...

PT-2023-31958 · WordPress · E2Pdf

Name of the Vulnerable Software and Affected Versions: E2Pdf WordPress plugin versions prior to 1.20.20 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, due to the plugin not sanitizing and escaping...

WordPress Plugin E2Pdf Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress e2pdf Plugin < 1.20.20 is vulnerable to Cross Site Scripting (XSS)

Software e2pdf Type Plugin Vulnerable versions 1.20.20 Fixed in 1.20.20 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-5229 Patch priority Low CVSS severity Low 5.9 Developer E2Pdf.com PSID 5dd49f4334ad Credits Yassir Sbai Fahim Required privilege Administrator...

WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection

Software e2pdf Type Plugin Vulnerable versions = 1.20.18 Fixed in 1.20.19 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-46154 Patch priority Low CVSS severity Low 6.6 Developer E2Pdf.com PSID f89d3fc37d51 Credits trein Required privilege Administrator Published 17...

E2Pdf < 1.20.20 - Admin+ Stored Cross-Site Scriping

Description The plugin does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed 1 Create a new template on...

E2Pdf < 1.20.20 - Admin+ Stored Cross-Site Scriping

Description The plugin does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC 1 Create a new template on...

WordPress E2Pdf Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress E2Pdf Plugin versions prior to 1.16.45 that stems fro...

CVE-2022-0535

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0535

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0535

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0535 E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)

The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0535

WordPress E2Pdf plugin prior to 1.16.45 is affected. The vulnerability is a Cross-Site Scripting flaw caused by insufficient sanitization/escaping of certain settings, allowing an attacker to inject scripts in the context of authenticated users even when unfiltered_html is disallowed. Impact coul...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress E2Pdf Plugin versions prior to 1.16.45 that stems fro...

E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)

The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Refer to https://mikadmin.fr/tech/XSS-Stored-E2Pdf-798ef69b0e13c36acf5446358d57c965Dx90666bNvCw98....

E2Pdf < 1.16.45 - Admin+ Stored Cross-Site Scripting (XSS)

The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Refer to https://mikadmin.fr/tech/XSS-Stored-E2Pdf-798ef69b0e13c36acf5446358d57c965Dx90666bNvCw98.pdf...