7659 matches found
CVE-2022-0706 Easy Digital Downloads < 2.11.6 - Admin+ Stored Cross-Site Scripting
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...
CVE-2022-0706
The CVE-2022-0706 entry concerns the WordPress plugin Easy Digital Downloads (EDD) before version 2.11.6. Affected component: the Downloadable File Name handling in Logs. Root cause: insufficient sanitisation and escaping of the downloadable file name, which could allow stored Cross-Site Scriptin...
CVE-2021-25120 Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting
The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX actions before outputting them back in the response, leading to Reflected Cross-Site Scripting issues...
CVE-2021-25120
The CVE-2021-25120 affects the WordPress plugins Easy Social Feed Free/Pro prior to version 6.2.7. Affected component: parameters used via AJAX actions that are not sanitized before being reflected in responses, enabling a reflected Cross-Site Scripting (XSS) condition. The issue can execute Java...
WordPress plugins Easy Social Feed Free 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Social Feed Free plugin is vulnerable to a cross-site scripting vulnerability that stems from...
WordPress plugin Easy Digital Downloads 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Digital Downloads plugin is vulnerable to a cross-site scripting vulnerability that stems from...
WordPress和WordPress plugin 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Digital Downloads plugin is vulnerable to cross-site request forgery, which originates from Ea...
Exploit for Exposure of Private Personal Information to an Unauthorized Actor in Easyappointments
Easy!Appointments PII disclosure Easy!Appointments --...
Easy!Appointments < 1.4.3 - Information Disclosure Exploit
!/usr/bin/env ruby Exploit Title: Easy!Appointments 1.4.3 - Unauthenticated PII events disclosure Exploit author: noraj Alexandre ZANNI for ACCEIS https://www.acceis.fr Author website: https://pwn.by/noraj/ Exploit source: https://github.com/Acceis/exploit-CVE-2022-0482 Vendor Homepage:...
Easy!Appointments Information Disclosure
!/usr/bin/env ruby Exploit Title: Easy!Appointments 1.4.3 - Unauthenticated PII events disclosure Exploit author: noraj Alexandre ZANNI for ACCEIS https://www.acceis.fr Author website: https://pwn.by/noraj/ Exploit source: https://github.com/Acceis/exploit-CVE-2022-0482 Date: 2022-04-11 Vendor...
CVE-2022-0728
The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-0840
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...
CVE-2022-0840
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...
Design/Logic Flaw
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...
CVE-2022-0840
The vulnerability is in the WordPress Easy Social Icons plugin (versions before 3.2.1). The image_file field is not properly escaped when adding a new social icon, enabling stored cross-site scripting. High-privilege users can inject arbitrary JavaScript even when unfiltered_html is disallowed. T...
CVE-2022-0840 Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...
CVE-2022-0728
The CVE-2022-0728 entry concerns the WordPress plugin Easy Smooth Scroll Links (prior to version 2.23.1). Affected component: plugin settings handling, which are not properly sanitized/escaped. Root cause: unfiltered input in plugin settings enables stored Cross-Site Scripting. Impact: could allo...
CVE-2022-0728 Easy Smooth Scroll Links < 2.23.1 - Admin+ Stored Cross-Site Scripting
The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
WordPress Easy Social Icons plugin SQL injection vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Easy Social Icons plugin has a SQL injection...