Mitsol Social Post Feed <= 1.10 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in the Access Token User access...

CVE-2022-22265

creationtimestamp| type| source ---|---|--- 2022-01-10 16:21:00+00:00| seen| https://t.me/cibsecurity/35164 2023-04-05 19:13:57+00:00| exploited| Telegram/b6MdP9MboN1sYxosDv05uyHi0qJf7CBXiU17JbE-8yXOq2Q 2023-09-18 18:10:02+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-09-21...

CVE-2021-25047 10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)

The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...

CVE-2021-25047

CVE-2021-25047 – 10Web Social Photo Feed Plugin : WordPress plugin versions before 1.4.29 are vulnerable to a reflected Cross-Site Scripting (XSS) on the wdi_apply_changes admin page, enabling an attacker to execute JavaScript in the context of any logged-in user. Root cause cited: lack of data v...

WordPress Product Feed PRO for WooCommerce plugin <= 11.0.6 - Settings Update to Stored Cross-Site Scripting (XSS) vulnerability

Settings Update to Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Product Feed PRO for WooCommerce plugin versions = 11.0.6. Solution Update the WordPress Product Feed PRO for WooCommerce plugin to the latest available version at least 11.0.7...

WordPress Smash Balloon Social Post Feed plugin <= 4.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Smash Balloon Social Post Feed plugin versions = 4.1. Solution Update the WordPress Smash Balloon Social Post Feed plugin to the latest available version at least 4.1.1...

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin was affected by a reflected XSS in custom-facebook-feed in cff-top admin page. PoC http://127.0.0.1:8001/wp-admin/admin.php?page=cff-topaccesstoken=xox%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert%281%29%3Efinalresponse=true...

CVE-2021-43890

creationtimestamp| type| source ---|---|--- 2021-12-15 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=704 2021-12-15 17:34:38+00:00| seen| https://t.me/truesecator/2447 2021-12-15 18:20:35+00:00| seen| https://t.me/cibsecurity/34035 2022-02-06 21:38:36+00:00| exploited|...

CVE-2021-44523

A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...

CVE-2021-44523

A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...

CVE-2021-44523

A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...

PriceOracle Does Not Filter Price Feed Outliers

Handle leastwood Vulnerability details Impact If for whatever reason the Chainlink oracle returns a malformed price due to oracle manipulation or a malfunctioned price, the result will be passed onto users, causing unintended consequences as a result. In the same time it's possible to construct...

CVE-2021-27860

creationtimestamp| type| source ---|---|--- 2021-12-08 20:22:49+00:00| seen| https://t.me/cibsecurity/33616 2023-05-25 16:46:30+00:00| seen| MISP/7544e906-dfda-47ae-ae7b-3ec0d5e26b56 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 17:04:48+00:00| seen|...

CVE-2021-20038

creationtimestamp| type| source ---|---|--- 2021-12-08 12:23:42+00:00| seen| https://t.me/cibsecurity/33566 2021-12-09 11:10:00+00:00| seen| https://t.me/truesecator/2424 2022-01-11 02:27:37+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1299 2022-01-11 18:24:46+00:00|...

10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)

The plugin was affected by a reflected Cross-Site Scripting XSS vulnerability in the wdiapplychanges admin page, allowing an attacker to perform such attack against any logged in users...

Chaty Free < 2.8.3 & Pro < 2.8.2 - Reflected Cross-Site Scripting

The plugins do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting http://example.com/wp-admin/admin.php?page=chaty-contact-form-feed&search=%3C%2Fscript%3E%3Cimg+src+onerror%3Dalert%28/XSS/%29%3E...

WordPress Smash Balloon Social Post Feed Plugin < 4.0.1 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Smash Balloon Social Post Feed Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress Plugin is a WordPress open source application plugin. WordPress Smash Balloon Social Post Feed...

CVE-2021-24918

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages...

CVE-2021-24918

CVE-2021-24918 affects the WordPress plugin Smash Balloon Social Post Feed (versions before 4.0.1). The root cause is missing privilege and nonce validation when saving plugin settings, allowing any logged-in user on a vulnerable site to update settings and store rogue JavaScript on posts and pag...