WordPress and WordPress plugin cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

Code injection

This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic...

Cross site request forgery (csrf)

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks...

WordPress WP Mail Log Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Mail Log Type Plugin Vulnerable versions = 1.0.2 Fixed in 1.1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 0ce743ed2f3d Credits Rafie Muhammad Patchstack Required...

WordPress WP System Log Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WP System Log Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c875cf2db794 Credits Rafie Muhammad Patchstack Required...

CVE-2023-3088 WP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via Email

The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

PT-2023-23032 · WordPress · Wp Mail Log

Name of the Vulnerable Software and Affected Versions: WP Mail Log plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is related to Stored Cross-Site Scripting via email contents due to insufficient input sanitization and output escaping. This allows unauthenticated...

CVE-2023-23721

Cross-Site Request Forgery CSRF vulnerability in David Gwyer Admin Log plugin = 1.50 versions...

CVE-2023-23721 WordPress Admin Log Plugin <= 1.50 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in David Gwyer Admin Log plugin = 1.50 versions...

CVE-2023-23721

CVE-2023-23721 affects the WordPress Admin Log plugin (

CVE-2022-45807

Cross-Site Request Forgery CSRF in WPVibes WP Mail Log plugin = 1.0.1 versions...

CVE-2022-45807 WordPress WP Mail Log Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in WPVibes WP Mail Log plugin = 1.0.1 versions...

WordPress Plugin WP Mail Log 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2022-25555 · Solwin Infotech · Solwin Infotech User Activity Log Plugin

Name of the Vulnerable Software and Affected Versions: Solwin Infotech User Activity Log Plugin affected versions not specified Description: A vulnerability has been found in the Solwin Infotech User Activity Log Plugin, affecting the HTTP Header Handler component. The manipulation of the...

GHSA-HW4F-G7WH-XP52 Cross-Site Request Forgery in Jenkins Delete log Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs...

GHSA-J874-47XX-9XFG Missing permission check in Jenkins Delete log Plugin

A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. As of publication of this advisory, there is no fix...

Cross-Site Request Forgery in Jenkins Delete log Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs...

CVE-2022-45393

A cross-site request forgery CSRF vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs...

CVE-2022-45393

A cross-site request forgery CSRF vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs...

Information disclosure

A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs...