CVE-2022-2425

The CVE-2022-2425 entry concerns the WP DS Blog Map WordPress plugin (versions up to 3.1.3).根 The underlying issue is that the plugin does not sanitize/escape certain settings, enabling Stored XSS when unfiltered_html is disallowed (e.g., multisite). Impact is described as allowing high-privilege...

CVE-2022-2410

CVE-2022-2410 affects the WordPress mTouch Quiz plugin up to version 3.1.3. The issue is due to insufficient sanitization/escaping of certain settings, enabling Stored XSS when unfiltered_html is disallowed (e.g., multisite). Affected component: plugin settings handling; root cause: lack of input...

Testimonial Builder < 1.6.2 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2022-16459 · WordPress · Rough Chart Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Rough Chart WordPress plugin versions through 1.0.0 Description: The issue concerns the Rough Chart WordPress plugin, which does not properly escape chart data labels. This could allow high-privilege users to perform Cross-Site Scripting...

PT-2022-16462 · WordPress · Mtouch-Quiz

Name of the Vulnerable Software and Affected Versions: mTouch Quiz WordPress plugin versions 3.1.3 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in a...

CVE-2022-21517

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of thi...

CVE-2022-2305

The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-0598

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0598 Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-15809 · WordPress · Wordpress Popup

Name of the Vulnerable Software and Affected Versions: WordPress Popup WordPress plugin versions 1.9.3.8 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for example in...

PT-2022-15917 · WordPress · Invitation Based Registrations

Name of the Vulnerable Software and Affected Versions: Invitation Based Registrations WordPress plugin versions 2.2.84 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed,...

PT-2022-13293 · WordPress · Login With Phone Number

Name of the Vulnerable Software and Affected Versions: Login with phone number WordPress plugin versions prior to 1.3.8 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape its settings, even when the...

Cross site scripting

The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-21563

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Core. The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to...

CVE-2022-21553

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2022-21527

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2022-21529

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2022-21512

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Integration Broker. Supported versions that are affected are 8.58 and 8.59. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise...

CVE-2022-21513

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: Core. The supported version that is affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle ZFS Storage Appliance Kit executes to...