WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress Insert Pages plugin has a cross-site scripting vulnerability in versions prior to 3.7.0, whi...

PT-2021-16333 · WordPress · Insert Pages

Name of the Vulnerable Software and Affected Versions: Insert Pages WordPress plugin versions prior to 3.7.0 Description: The issue allows users with a role as low as Contributor to access content and metadata from arbitrary posts or pages, regardless of their author and status, including private...

PT-2021-16332

Name of the Vulnerable Software and Affected Versions: Insert Pages WordPress plugin versions prior to 3.7.0 Description: The issue allows users with a role as low as Contributor to perform Cross-Site Scripting attacks. This is achieved by storing payloads in another post's custom fields, which c...

Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access

The plugin allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status ie private, using a shortcode. Password protected posts/pages are not affected by such issue. insert page='pageslug' display='all' Where pagesl...

Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access

The plugin allows users with a role as low as Contributor to access content and metadata from arbitrary posts/pages regardless of their author and status ie private, using a shortcode. Password protected posts/pages are not affected by such issue. PoC insert page='pageslug' display='all' Where...

Insert Pages < 3.7.0 - Contributor+ Stored Cross-Site Scripting

The plugin adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields. PoC - Create a page A - Add a custom field containing JS...

WordPress Insert Pages plugin <= 3.6.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Francesco Carlucci in WordPress Insert Pages plugin versions = 3.6.1. Solution Update the WordPress Insert Pages plugin to the latest available version at least 3.7.0...

Insert Pages < 3.7.0 - Contributor+ Stored Cross-Site Scripting

The plugin adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields. - Create a page A - Add a custom field containing JS in...

CVE-2017-18586

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...

Directory traversal

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...

CVE-2017-18586

CVE-2017-18586 affects the WordPress plugin Insert Pages (pre-3.2.4). The vulnerability is a directory-traversal flaw via custom template paths, allowing access to unintended files. Affected versions are prior to 3.2.4; remediation is to upgrade to 3.2.4 or later (plugin page: insert-pages). If e...

CVE-2017-18586

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...

CVE-2017-18586

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...

PT-2019-8520

Name of the Vulnerable Software and Affected Versions insert-pages plugin versions prior to 3.2.4 Description The issue allows for directory traversal through custom template paths. Recommendations For versions prior to 3.2.4, update to version 3.2.4 or later to resolve the issue...

CVE-2017-18586: Improper Limitation of a Pathname to a Restricted Directory

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths...

Insert Pages < 3.2.4 - Directory Traversal

The Insert Pages WordPress plugin was affected by a Directory Traversal security vulnerability...

PT-2015-3701

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities in INSERT pages. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML vi...

CVE-2014-2153: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in INSERT pages in Cisco Prime Infrastructure allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCun21869...