3817 matches found
CVE-2022-4369 WP-Lister Lite for Amazon < 2.4.4 - Reflected XSS
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin...
CVE-2022-4369 WP-Lister Lite for Amazon < 2.4.4 - Reflected XSS
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin...
CVE-2022-4358
The CVE-2022-4358 entry concerns the WP RSS By Publishers WordPress plugin (version
CVE-2022-3936 Team Members < 5.2.1 - Editor+ Stored XSS
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in a multisite setup...
CVE-2022-3936 Team Members < 5.2.1 - Editor+ Stored XSS
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in a multisite setup...
CVE-2022-4355 LetsRecover < 1.2.0 - Admin+ SQLi
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-4355 LetsRecover < 1.2.0 - Admin+ SQLi
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-4302 White Label CMS < 2.5 - Admin+ PHP Object Injection
The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...
CVE-2022-4360 WP RSS By Publishers <= 0.1 - Admin+ SQLi
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-4351 Qe SEO Handyman <= 1.0 - Admin+ SQLi
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-4371 Web Invoice <= 2.1.3 - Authenticated SQLi
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as...
PT-2023-14287 · WordPress · Wp-Lister Lite For Amazon
Name of the Vulnerable Software and Affected Versions: WP-Lister Lite for Amazon WordPress plugin versions prior to 2.4.4 Description: The issue is related to a Reflected Cross-Site Scripting that can be used against high-privilege users such as admin. This occurs because the plugin does not...
PT-2023-14265 · WordPress · Wp Rss By Publishers
Name of the Vulnerable Software and Affected Versions: WP RSS By Publishers WordPress plugin version 0.1 Description: The issue is related to a SQL injection that occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement. This can be exploited by high...
PT-2023-14230 · WordPress · Qe Seo Handyman Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: Qe SEO Handyman WordPress plugin versions 1.0 and earlier Description: The issue arises from the plugin's failure to properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploite...
PT-2023-14060 · WordPress · Login With Cognito
Name of the Vulnerable Software and Affected Versions: Login with Cognito WordPress plugin versions 1.4.8 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...
PT-2023-14267 · WordPress · Wp Rss By Publishers
Name of the Vulnerable Software and Affected Versions: WP RSS By Publishers WordPress plugin version 0.1 Description: The issue is related to a SQL injection that occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement. This can be exploited by high...
PT-2023-13721 · WordPress · Team Members
Name of the Vulnerable Software and Affected Versions: The Team Members WordPress plugin versions prior to 5.2.1 Description: The issue allows high-privilege users, such as editors, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example...
PT-2023-14170 · WordPress · White Label Cms
Name of the Vulnerable Software and Affected Versions: White Label CMS WordPress plugin versions prior to 2.5 Description: The issue allows high-privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input...
CVE-2022-3922 Broken Link Checker < 1.11.20 - Admin+ Cross-Site Scripting
The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
