WordPress plugin WIP Custom Login security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Login as User or Customer (User Switching) Plugin <= 3.8 is vulnerable to Privilege Escalation

Software Login as User or Customer User Switching Type Plugin Vulnerable versions = 3.8 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51484 Patch priority Low CVSS severity Low 9.8 Developer Claim ownership PSID...

CVE-2023-27461

Cross-Site Request Forgery CSRF vulnerability in Yoohoo Plugins When Last Login plugin = 1.2.1 versions...

CVE-2023-34025

Cross-Site Request Forgery CSRF vulnerability in LWS LWS Hide Login plugin = 2.1.6 versions...

CVE-2023-46777

Cross-Site Request Forgery CSRF vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin = 1.1.3 versions...

WordPress Feather Login Page Plugin <= 1.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Feather Login Page Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46777 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 62aa1ddd991f Credits Mika Required...

Cross site request forgery (csrf)

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwpupdatepasswordaction' function. This makes it possible for unauthenticated attackers to change user password via...

CVE-2023-4916 Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwpupdatepasswordaction' function. This makes it possible for unauthenticated attackers to change user password via...

PT-2023-31077 · WordPress · Login With Phone Number Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Login with phone number plugin for WordPress versions up to, and including, 1.5.6 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the lwp update password action function. This allows...

CVE-2023-41936

Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing attackers to use statistical methods to obtain a valid token...

CVE-2023-41936

Summary : CVE-2023-41936 affects Jenkins Google Login Plugin 1.7 and earlier. The vulnerability arises from a non-constant time token comparison function used when verifying the provided versus expected token, enabling attackers to use statistical methods to obtain a valid token. The connected so...

CVE-2023-38476

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direct Login plugin = 1.7.6 versions...

CVE-2023-38476

CVE-2023-38476 : Auth. (admin+) Stored XSS in the WordPress plugin “SuiteDash Direct Login” for SuiteDash :: ONE Dashboard Client Portal, affected

CVE-2023-37986

CVE-2023-37986 affects the miniOrange YourMembership Single Sign On (YM SSO) Login WordPress plugin, versions

CVE-2023-34172

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Miled WordPress Social Login plugin = 3.0.4 versions...

CVE-2023-34023

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Miled WordPress Social Login plugin = 3.0.4 versions...

CVE-2023-34172

CVE-2023-34172 describes an authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WordPress Social Login (Miled WordPress Social Login) up to version ≤ 3.0.4. Root cause: stored XSS likely via admin-accessible vector in the plugin. Impact: local XSS could ...

CVE-2023-32505

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Arshid Easy Hide Login plugin = 1.0.7 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Arshid Easy Hide Login plugin = 1.0.7 versions...

Jenkins plugins Multiple Vulnerabilities (2022-12-07)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. CVE-2022-46682 - Jenki...