CVE-2023-47696

Unauth. Stored Cross-Site Scripting XSS vulnerability in Gravity Master Product Enquiry for WooCommerce plugin = 3.0 versions...

CVE-2023-47696

Unauth. Stored Cross-Site Scripting XSS vulnerability in Gravity Master Product Enquiry for WooCommerce plugin = 3.0 versions...

Cross site scripting

Unauth. Stored Cross-Site Scripting XSS vulnerability in Gravity Master Product Enquiry for WooCommerce plugin = 3.0 versions...

CVE-2023-47696 WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Stored Cross-Site Scripting XSS vulnerability in Gravity Master Product Enquiry for WooCommerce plugin = 3.0 versions...

CVE-2023-47696

The CVE-2023-47696 entry concerns the Gravity Master Product Enquiry for WooCommerce plugin for WordPress. Affected component: the plugin’s input handling/escaping allows unauthenticated Stored XSS. Vulnerable versions are ≤ 3.0; the issue is mitigated in version 3.1. The attack vector is network...

PT-2023-30572 · Woocommerce · Gravity Master Product Enquiry For Woocommerce

Name of the Vulnerable Software and Affected Versions: Gravity Master Product Enquiry for WooCommerce plugin versions = 3.0 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be stored on the server and executed when...

Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC The "Translations" settings of the...

Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup The "Translations" settings of the...

CVE-2023-5135

The Simple Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gravity-simple-turnstile' shortcode in versions up to, and including, 1.23.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-2705 Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting

The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin...

CVE-2023-2705 Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting

The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin...

WordPress plugin Appointment booking addon for Gravity Forms Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin 1. Create a "Service" and a "Provider" under the "gAppointments" sidebar menu. 2. Create a new form within Gravity...

Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin PoC 1. Create a "Service" and a "Provider" under the "gAppointments" sidebar menu. 2. Create a new form within...

CVE-2023-37980

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gravity Master Custom Field For WP Job Manager plugin = 1.1 versions...

CVE-2023-37980

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gravity Master Custom Field For WP Job Manager plugin = 1.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gravity Master Custom Field For WP Job Manager plugin = 1.1 versions...

CVE-2023-37980 WordPress Custom Field For WP Job Manager Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gravity Master Custom Field For WP Job Manager plugin = 1.1 versions...

CVE-2023-37980

CVE-2023-37980 affects the Gravity Master Custom Field For WP Job Manager plugin (WordPress) up to version 1.1. It is an authenticated stored XSS vulnerability exploitable by an administrator (admin+) to inject script via the Custom Field for WP Job Manager. Root cause details in the sources indi...

PT-2023-26228 · WordPress · Gravity Master Custom Field For Wp Job Manager

Name of the Vulnerable Software and Affected Versions: Gravity Master Custom Field For WP Job Manager plugin versions = 1.1 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious...