CVE-2022-1566

The Quotes llama WordPress plugin (pre-1.0.0) is vulnerable due to lack of sanitisation/escaping of quotes, enabling stored Cross-Site Scripting by high-privilege admins (e.g., via regular input or CSV import). Impact is client-side script execution within admin/affected pages; remediation provid...

WordPress plugin Quotes llama 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Quotes llama plugin 0.7 and earlier versions have a cross-site scripting vulnerability that...

PT-2022-13965 · WordPress · Quotes Llama Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Quotes llama WordPress plugin versions prior to 1.0.0 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks even when unfiltered html is disallowed. This can be achieved by exploiting the...

Quotes llama < 1.0.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file Create/edit a quote and put t...

Quotes llama < 1.0.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file PoC Create/edit a quote and p...

WordPress Quotes llama plugin < 1.0.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Benachi in WordPress Quotes llama plugin versions 1.0.0. Solution Update the WordPress Quotes llama plugin to the latest available version at least 1.0.0...

lightbeam (>=0.7.0, <=0.15.0), llama-wasm (>=0.1.0, <=0.5.0) +1 more potentially affected by unknown CVE via multi_mut (0.1.3)

multimut CARGO version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on multimut and may be impacted: - lightbeam =0.7.0, =0.1.0, =0.7.0, =0.15.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0169...

Llama - Location Profiles - External URLs, Possible privilege escalation, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application Llama - Location Profiles published at the 'play' market has multiple vulnerabilities...