PT-2022-13203

Name of the Vulnerable Software and Affected Versions The Event Manager and Tickets Selling for WooCommerce WordPress plugin versions prior to 3.5.8 Description The issue concerns a lack of validation and escaping for the post author gutenberg parameter in SQL statements when creating or editing...

WordPress plugin: WooCommerce SQL injection vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. SQL injection vulnerability exists in versions of...

WordPress Gutenberg plugin <= 12.7.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Ben Bidner in WordPress Gutenberg plugin versions = 12.7.1. Solution Update the WordPress Gutenberg plugin to the latest available version at least 12.7.2...

WordPress (5.9-5.9.1) / Gutenberg (9.8.0-12.7.1) - Contributor+ Stored Cross-Site Scripting

Description Post authors are able to bypass KSES restrictions in WordPress = 5.9 and or Gutenberg = 9.8.0 due to the order filters are executed, which could allow them to perform to Stored Cross-Site Scripting attacks As a user without the UNFILTEREDHTML capability, create a post containing the...

WordPress < 5.9.2 / Gutenberg < 12.7.2 - Prototype Pollution via Gutenberg’s wordpress/url package

Description The @wordpress/url package used in WordPress and the Gutenberg plugin is affected by a Prototype Pollution issue...

WordPress (5.9-5.9.1) / Gutenberg (9.8.0-12.7.1) - Contributor+ Stored Cross-Site Scripting

Description Post authors are able to bypass KSES restrictions in WordPress = 5.9 and or Gutenberg = 9.8.0 due to the order filters are executed, which could allow them to perform to Stored Cross-Site Scripting attacks PoC As a user without the UNFILTEREDHTML capability, create a post containing t...

WordPress Local SEO For Divi & Gutenberg Blocks plugin <= 9.1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Local SEO For Divi & Gutenberg Blocks plugin versions = 9.1.2. Solution Update the WordPress Local SEO For Divi & Gutenberg Blocks plugin to the latest available version at least 9.1.3...

WordPress Page Builder Gutenberg Blocks – Kioken Blocks plugin <= 1.3.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Page Builder Gutenberg Blocks – Kioken Blocks plugin versions = 1.3.9. Solution No patched version available...

WordPress BlockyPage – Gutenberg Based Page Builder plugin <= 1.2.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress BlockyPage – Gutenberg Based Page Builder plugin versions = 1.2.4. Solution No patched version available...

WordPress Blocks Bakery – Gutenberg Blocks plugin <= 1.0.12 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Blocks Bakery – Gutenberg Blocks plugin versions = 1.0.12. Solution No patched version available...

WordPress WP Custom field for Gutenberg Editor plugin <= 1.7.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Custom field for Gutenberg Editor plugin versions = 1.7.1. Solution No patched version available...

WordPress Blocks Bakery – Gutenberg Blocks plugin <= 1.0.12 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Blocks Bakery – Gutenberg Blocks plugin versions = 1.0.12. Solution No patched version available...

WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin <= 5.4.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin versions = 5.4.0. Solution Update the WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin to the latest available version at least 5.4.1...

WordPress Pinblocks — Gutenberg blocks with Pinterest widgets plugin <= 1.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Pinblocks — Gutenberg blocks with Pinterest widgets plugin versions = 1.0.2. Solution No patched version available...

WordPress WP Custom field for Gutenberg Editor plugin <= 1.7.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Custom field for Gutenberg Editor plugin versions = 1.7.1. Solution No patched version available...

WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin <= 5.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin versions = 5.4.0. Solution Update the WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin to the latest available version at leas...

WordPress Best Responsive Comparison Table for Gutenberg Editor – NicheTable plugin <= 2.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Best Responsive Comparison Table for Gutenberg Editor – NicheTable plugin versions = 2.2.0. Solution Update the WordPress Best Responsive Comparison Table for Gutenberg Editor – NicheTable plugin to th...

WordPress Ultimate Gutenberg – Custom Block Templates plugin <= 2.5.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Gutenberg – Custom Block Templates plugin versions = 2.5.1. Solution No patched version available...

WordPress Multipurpose Gutenberg Block plugin <= 1.7.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Multipurpose Gutenberg Block plugin versions = 1.7.3. Solution Update the WordPress Multipurpose Gutenberg Block plugin to the latest available version at least 1.7.4...

WordPress Template Manager for Gutenberg Block plugin <= 1.0.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Template Manager for Gutenberg Block plugin versions = 1.0.5. Solution No patched version available...