WordPress Editorial Assistant by Sovrn plugin <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image vulnerability

Missing Authorization to Authenticated Subscriber+ Attachment Upload and Set Post Featured Image vulnerability discovered by István Márton in WordPress Plugin Editorial Assistant by Sovrn versions = 1.3.3...

Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes

Impact One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are passed to the node component using the nodeProps prop. Note: The attributes prop that is typically rendered alongside nodeProps is...

Symphony CMS 安全漏洞

Symphony CMS is a content management system from Symphony CMS open source. A security vulnerability exists in Symphony CMS version 2.7.10, which stems from the presence of a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via editorial...

TikTok Editorial Analysis

TikTok seems to be skewing things in the interests of the Chinese Communist Party. This is a serious analysis, and the methodology looks sound. Conclusion: Substantial Differences in Hashtag Ratios Raise Concerns about TikToks Impartiality Given the research above, we assess a strong possibility...

CVE-2023-36520

Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12...

CVE-2023-36520

Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12...

Authorization

Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12...

CVE-2023-36520 WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12...

WordPress Plugin Editorial Calendar Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-25607 · Unknown · Marketingfire Editorial Calendar

Name of the Vulnerable Software and Affected Versions: MarketingFire Editorial Calendar versions 3.7.12 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar. Recommendations: For versions 3.7.12 and...

WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)

Software Multicollab – Google Doc-Style Editorial Commenting for WordPress Type Plugin Vulnerable versions = 3.1 Fixed in 3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 946cd7dfe9f...

WordPress Content Scheduler: Editorial Calendar and Notes Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Content Scheduler: Editorial Calendar and Notes Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bce889e4798c Credits...

CVE-2022-4115

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users...

CVE-2022-4115 Editorial Calendar < 3.8.3 - Contributor+ Stored XSS

The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users...

WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)

Software Editorial Calendar Type Plugin Vulnerable versions = 3.7.12 Fixed in 3.8.0 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-36520 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5cbcd0860491 Credits Elliot...

PT-2023-13960 · WordPress · Editorial Calendar

Name of the Vulnerable Software and Affected Versions: Editorial Calendar WordPress plugin versions prior to 3.8.3 Description: The issue allows users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability...

WordPress plugin Editorial Calendar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Editorial Calendar Plugin <= 3.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Editorial Calendar Type Plugin Vulnerable versions = 3.8.0 Fixed in 3.8.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4115 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ecc03a6dec25 Credits iohex Required...

editorialconfluencias.com Cross Site Scripting vulnerability OBB-3337959

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

contraluzeditorial.es Cross Site Scripting vulnerability OBB-3302847

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...