PT-2023-29459 · WordPress · Import Xml/Rss Feeds

Name of the Vulnerable Software and Affected Versions: Import XML and RSS Feeds WordPress plugin versions prior to 2.1.5 Description: The issue allows unauthenticated attackers to perform remote code execution RCE due to a web shell in the plugin. This web shell was introduced as a result of a...

CVE-2023-4300: Undefined Security Weakness

The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution...

WordPress plugin Import XML and RSS Feeds Code Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in th...

PT-2023-28663 · WordPress · Import Xml/Rss Feeds

Name of the Vulnerable Software and Affected Versions: Import XML and RSS Feeds WordPress plugin versions prior to 2.1.4 Description: The issue allows an attacker to upload a malicious PHP file due to a lack of file extension filtering for uploaded files, leading to Remote Code Execution...

CVE-2023-41179

creationtimestamp| type| source ---|---|--- 2023-09-19 15:22:39+00:00| exploited| https://t.me/informationsecuritychannel/50671 2023-09-19 18:29:32+00:00| seen| https://t.me/cibsecurity/70731 2023-09-20 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1114 2023-09-20...

CVE-2023-39643

Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds...

CVE-2023-4841

The Feeds for YouTube for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-4841

The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers wit...

CVE-2023-4841 Feeds for YouTube <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers wit...

CVE-2023-4841

CVE-2023-4841 affects the Feeds for YouTube for WordPress plugin. Vulnerable in versions up to 2.1 due to insufficient input sanitization/output escaping in the youtube-feed shortcode, allowing authenticated users with contributor+ rights to inject XSS. Remediation: update to version 2.1.2 (patch...

WordPress Feeds for YouTube Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

Software Feeds for YouTube Type Plugin Vulnerable versions = 2.1 Fixed in 2.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4841 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9fd258b26a01 Credits Lana Codes Required...

CVE-2023-4841: Improper Neutralization of Input During Web Page Generation

The Feeds for YouTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'youtube-feed' shortcode in versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers wit...

WordPress Plugin Feeds for YouTube Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2023-30830 · WordPress · Feeds For Youtube

Name of the Vulnerable Software and Affected Versions: Feeds for YouTube for WordPress plugin for WordPress versions up to, and including, 2.1 Description: The issue is related to Stored Cross-Site Scripting via the 'youtube-feed' shortcode due to insufficient input sanitization and output escapi...

CVE-2023-28229

creationtimestamp| type| source ---|---|--- 2023-09-04 17:10:23+00:00| published-proof-of-concept| https://t.me/CNArsenal/1004 2023-09-06 19:13:17+00:00| published-proof-of-concept| https://t.me/WARLOCKDARKARMYOFFICIALS/3056 2023-09-07 08:00:59+00:00| published-proof-of-concept|...

CVE-2023-41266

creationtimestamp| type| source ---|---|--- 2023-08-30 02:17:51+00:00| seen| https://t.me/cibsecurity/69406 2023-11-30 08:45:23+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus28/2023 2023-11-30 17:55:24+00:00| seen| https://t.me/truesecator/5149 2023-12-03 17:01:28+00:00| see...

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

Description The plugin contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42 and not deletin...

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

Description The plugin contains a web shell, allowing unauthenticated attackers to perform RCE. The plugin/vendor was not compromised and the files are the result of running a PoC for a previously reported issue https://wpscan.com/vulnerability/d4220025-2272-4d5f-9703-4b2ac4a51c42 and not deletin...

CVE-2023-1977

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...

CVE-2023-38180

creationtimestamp| type| source ---|---|--- 2023-08-08 22:20:25+00:00| seen| https://t.me/cibsecurity/68048 2023-08-09 10:07:43+00:00| seen| https://t.me/kasperskyb2b/792 2023-08-09 11:06:10+00:00| seen| https://t.me/truesecator/4707 2023-08-09 12:30:05+00:00| exploited| https://t.me/itsecnews/30...