WordPress StreamWeasels Twitch Integration plugin <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-twitch-embed Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via sw-twitch-embed Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin StreamWeasels Twitch Integration versions = 1.8.6...

CVE-2024-9346

The Embed videos and respect privacy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'v' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress plugin Embed videos and respect privacy 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

PT-2024-39582 · WordPress · Embed Videos/Respect Privacy

Name of the Vulnerable Software and Affected Versions: Embed videos and respect privacy plugin for WordPress versions prior to 1.2 Description: The issue allows unauthenticated attackers to inject arbitrary web scripts in pages due to insufficient input sanitization and output escaping via the v...

WordPress Embed videos and respect privacy plugin <= 1.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Embed videos and respect privacy versions = 1.2...

WordPress Embed videos and respect privacy Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Embed videos and respect privacy Type Plugin Vulnerable versions = 1.2 Fixed in 1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9346 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 8c77aba3d299 Credits vgo0 Requir...

WordPress plugin Embed PDF Viewer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. WordPress plugin Embed PDF Viewer...

PT-2024-39641 · WordPress · Embed Pdf Viewer

Name of the Vulnerable Software and Affected Versions: Embed PDF Viewer plugin for WordPress versions up to, and including, 2.4.4 Description: The issue is related to Stored Cross-Site Scripting via the height and width parameters due to insufficient input sanitization and output escaping. This...

WordPress Embed PDF Viewer plugin <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by tjoffe in WordPress Plugin Embed PDF Viewer versions = 2.4.4...

WordPress Embed PDF Viewer Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Embed PDF Viewer Type Plugin Vulnerable versions = 2.4.4 Fixed in 2.4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9451 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f682b615e5b7 Credits tjoffe Required privile...

CVE-2024-45291 Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with $writer-setEmbedImagestrue; those files will be included in th...

CVE-2024-45291 Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with $writer-setEmbedImagestrue; those files will be included in th...

Absolute Path Traversal

Overview Affected versions of this package are vulnerable to Absolute Path Traversal via the HTML writer process when embedding images. An attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests by constructing an XLSX file that links images from arbitrary paths or...

CVE-2024-25701

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the Experience Builder Embed widget which when loaded could potentially...

CVE-2024-8804

The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions up to, and including, 2.4 due to insufficient restrictions on who can utilize the functionality. This makes it possible for authenticated attackers, with...

CVE-2024-8804 Code Embed <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions up to, and including, 2.4 due to insufficient restrictions on who can utilize the functionality. This makes it possible for authenticated attackers, with...

CVE-2024-8804

CVE-2024-8804 affects the WordPress Code Embed plugin, with a stored XSS in the plugin’s script embed feature that affects all versions up to 2.4. An attacker with contributor-level access or higher can inject arbitrary scripts that execute when users load the affected pages. The vulnerability is...

WordPress Code Embed plugin <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Leo in WordPress Plugin Code Embed versions = 2.4...

WordPress Code Embed Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS)

Software Code Embed Type Plugin Vulnerable versions = 2.4 Fixed in 2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8804 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 053ae53cce0b Credits Leo Required privilege Contributo...

WordPress plugin Code Embed 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...