WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugins is an open source application plugin for WordPress. A security vulnerability exists in the WordPress...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

CVE-2021-24540: Improper Neutralization of Input During Web Page Generation

The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderpluginvideo shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks...

Daily Prayer Time < 2021.08.10 - Authenticated Stored XSS

The plugin does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues. Put the following payload in the Fajr, Sunrise, Zuhr, Asr, Maghrib and/or Isha field of the Language settings of the plugin...

CVE-2021-24464

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24464

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24464 YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSS

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24464: Improper Neutralization of Input During Web Page Generation

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise some of its shortcode options, available to users with a role as low as Contributor, leading to an authenticated Stored Cross-Site Scripting issue...

PT-2021-15989

Name of the Vulnerable Software and Affected Versions YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin versions prior to 2.3.9 Description The issue is related to an authenticated Stored Cross-Site Scripting problem. It occurs because some shortcode options in the plugin do not...

Wonder Video Embed < 1.8 - Contributor+ Stored XSS

The plugin does not escape parameters of its wonderpluginvideo shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. PoC wonderpluginvideo iframe='youtube.com?v=dQw4w9WgXcQ" onload="alert1'...

WordPress Wonder PDF Embed plugin <= 1.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Wonder PDF Embed plugin versions = 1.6. Solution Update the WordPress Wonder PDF Embed plugin to the latest available version at least 1.7...

Wonder PDF Embed < 1.7 - Contributor+ Stored XSS

The plugin does not escape parameters of its wonderpluginpdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. PoC wonderpluginpdf src="a" onload="alert1"...

Wonder Video Embed < 1.8 - Contributor+ Stored XSS

The plugin does not escape parameters of its wonderpluginvideo shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. wonderpluginvideo iframe='youtube.com?v=dQw4w9WgXcQ" onload="alert1' videocss='animation-name:twentytwentyone-close-button-transition"...

Wonder PDF Embed < 1.7 - Contributor+ Stored XSS

The plugin does not escape parameters of its wonderpluginpdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. wonderpluginpdf src="a" onload="alert1"...

IBM Cloud Pak for Applications Cross-Site Scripting Vulnerability (CNVD-2022-05121)

IBM Cloud Pak for Applications is an application from IBM USA, Inc. IBM Cloud Pak for Applications has a security vulnerability that stems from the fact that Cloud Pak for Applications allows users to embed arbitrary JavaScript code in the Web UI to change the intended functionality. An attacker...

wagtail-stacks-embed (>=0.1.0, <=0.3.0) potentially affected by CVE-2021-32681 via wagtail (1.7.0)

wagtail PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-stacks-embed =0.1.0, =0.3.0 Source cves: CVE-2021-32681 Source advisory: OSV:GHSA-XFRW-HXR5-GHQF...

wagtail-stacks-embed (>=0.1.0, <=0.3.0) potentially affected by CVE-2021-32681 via wagtail (1.7.0)

wagtail PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-stacks-embed =0.1.0, =0.3.0 Source cves: CVE-2021-32681 Source advisory: OSV:PYSEC-2021-103...

com.github.fanzezhen.common:common-security (>=0.0.1, <=2.0.3), com.github.fanzezhen:security (>=1.3.3, <=1.3.4.4) +6 more potentially affected by CVE-2021-25122 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.0.1, =1.3.3, =5.22, =10.0.0-m1, =10.0.0-m1, =3.15.0, =3.16.8 - su.boleyn.oj:oj-server 1.1.2 Source cves: CVE-2021-25122 Source advisory: GHSA-J39C-C8HJ-X4J3...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4033 more potentially affected by CVE-2021-25122 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.61)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2021-25122 Source...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4033 more potentially affected by CVE-2021-25122 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.61)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2021-25122 Source...