CVE-2023-1068

CVE-2023-1068 affects the WordPress plugin Download Read More Excerpt Link (versions

PT-2023-16734 · WordPress · Download Read More Excerpt Link

Name of the Vulnerable Software and Affected Versions: Download Read More Excerpt Link plugin for WordPress versions up to, and including, 1.6.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the read more excerpt link menu options...

CVE-2023-1068: Cross-Site Request Forgery (CSRF)

The Download Read More Excerpt Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the readmoreexcerptlinkmenuoptions function. This makes it possible for unauthenticated attackers t...

WordPress Plugin Download: Read More Excerpt Link – Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress Read More Excerpt Link Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Read More Excerpt Link Type Plugin Vulnerable versions = 1.6 Fixed in 1.6.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-26011 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 838704e6067f Credits Mika Required...

SUSE CVE-2017-5612

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...

A Hacker’s Mind News

A Hackers Mind will be published on Tuesday. I have done a written interview and a podcast interview about the book. Its been chosen as a "February 2023 Must-Read Book" by the Next Big Idea Club. And an "Editors Pick"--whatever that means--on Amazon. There have been three reviews so far. I am...

CVE-2022-37679

Miniblog.Core v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field...

CVE-2022-37679

Miniblog.Core v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field...

Cross site scripting

Miniblog.Core v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field...

CVE-2022-37679

Miniblog.Core v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field...

CVE-2022-37679

Miniblog.Core v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field...

PT-2022-24038 · Unknown · Miniblog.Core

Name of the Vulnerable Software and Affected Versions: Miniblog.Core version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field in the "/blog/edit" API endpoint. This enables the execution of malicious code on...

MadSkristensen Miniblog.Core Cross-Site Scripting Vulnerability

madskristensen Miniblog.Core is a blogging engine built on ASP.NET Core. A security vulnerability exists in madskristensen Miniblog.Core v1.0, which allows attackers to execute arbitrary web script or HTML by injecting a crafted payload into the Excerpt field via the /blog/edit component...

CVE-2022-37679: Improper Neutralization of Input During Web Page Generation

Miniblog.Core v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field...

CVE-2020-36290

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting XSS...

CVE-2020-36290

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting XSS...

CVE-2020-36290: Improper Neutralization of Input During Web Page Generation

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting XSS...

CVE-2021-42749

In Beaver Themer, attackers can bypass conditional logic controls for hiding content when viewing the post archives. Exploitation requires that a Themer layout is applied to the archives, and that the post excerpt field is not set...

WordPress plugin security vulnerabilities

WordPress plugin is an open source application plugin for WordPress. A security vulnerability exists in WordPress plugin, which originates in Beaver Themer, and can be exploited by an attacker to bypass conditional logic controls used to hide content when viewing a post archive, utilizing the...