Authorization

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4622 Login Logout Menu <= 1.3.3 - Contributor+ Stored XSS in Shortcode

The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4622 Login Logout Menu <= 1.3.3 - Contributor+ Stored XSS in Shortcode

The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4622

The CVE-2022-4622 issue affects the WordPress plugin Login Logout Menu (versions

CVE-2022-4385

Summary: The WordPress plugin Intuitive Custom Post Order (

CVE-2022-4385 Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

WordPress Login Logout Menu Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Login Logout Menu Type Plugin Vulnerable versions = 1.3.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4622 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 93394eba834d Credits Lana Codes Require...

WordPress Plugin Intuitive Custom Post Order 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Plugin Login Logout Menu 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-14374

Name of the Vulnerable Software and Affected Versions Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4 Description The issue allows any logged-in user, with roles as low as Subscriber, to update the menu order due to a lack of authorization check in the update-menu-order ajax...

PT-2023-14375

Name of the Vulnerable Software and Affected Versions Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4 Description The issue lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user into changing the menu order via a CSRF attack...

CVE-2022-4622: Undefined Security Weakness

The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4385: Missing Authorization

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

CVE-2022-4386: Cross-Site Request Forgery (CSRF)

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

PT-2023-14858

Name of the Vulnerable Software and Affected Versions Login Logout Menu WordPress plugin versions 1.3.3 and earlier Description The issue is related to the lack of validation and escaping of some shortcode attributes in the Login Logout Menu WordPress plugin, which could allow users with the...

Cross-site Scripting in jspreadsheet

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

PT-2023-15577

Name of the Vulnerable Software and Affected Versions jspreadsheet versions prior to 4.6.0 Description The dropdown menu in jspreadsheet was discovered to be vulnerable to cross-site scripting XSS. Recommendations For versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue...

CVE-2022-48115: Improper Neutralization of Input During Web Page Generation

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

CVE-2022-48115

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

CVE-2022-48115

CVE-2022-48115 affects jspreadsheet CE prior to 4.6.0, with a cross-site scripting (XSS) vulnerability in the dropdown/menu code path. Root cause identified as insufficient sanitization/handling in the dropdown implementation, enabling attacker-controlled input to execute scripts in a victim’s br...