CVE-2020-25378

Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting XSS via the id GET parameter...

CVE-2020-25378

Summary (grounded): CVE-2020-25378 affects WordPress plugins from AccessPress Themes: WP Floating Menu, version 1.3.0. The vulnerability is a Cross Site Scripting (XSS) weakness triggered by the id parameter in the GET request (reflected XSS). Some sources describe the issue as authenticated and ...

CVE-2020-25378: Improper Neutralization of Input During Web Page Generation

Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting XSS via the id GET parameter...

WordPress Sticky Menu, Sticky Header (or anything!) on Scroll plugin <= 2.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Antony Garand Sucuri in WordPress Sticky Menu, Sticky Header or anything! on Scroll plugin versions = 2.2. Solution Update the WordPress Sticky Menu, Sticky Header or anything! on Scroll plugin to the latest available version at least 2.21...

Malicious Package in ngx-context-menu

Version 0.0.26 of ngx-context-menu contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...

GHSA-XWG3-GJXH-C8PM Malicious Package in ngx-context-menu

Version 0.0.26 of ngx-context-menu contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...

Malicious Package in mx-nested-menu

Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluat...

GHSA-48HW-37G6-3GW4 Malicious Package in mx-nested-menu

Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluat...

PT-2020-21007

Name of the Vulnerable Software and Affected Versions mx-nested-menu version 0.1.30 Description The issue concerns malicious code in version 0.1.30 of mx-nested-menu. When executed in a browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the extracted values to...

PT-2020-21599

Name of the Vulnerable Software and Affected Versions ngx-context-menu version 0.0.26 Description The issue concerns malicious code in version 0.0.26 of ngx-context-menu. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends t...

WP Floating Menu < 1.4.1 - Authenticated Reflected Cross-Site Scripting

The id GET parameter used by WP Floating menu does not correctly sanitise user input before reflecting the parameter back to the user, resulting in a reflected XSS vulnerability. Other sanitisation have been added to prevent other XSS issues as well as potential SQL injections. PoC...

WordPress WP Floating Menu plugin <= 1.4.0 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by ZeroAptitude in WordPress WP Floating Menu plugin versions = 1.4.0. Solution Update the WordPress WP Floating Menu plugin to the latest available version at least 1.4.1...

WP Floating Menu < 1.4.1 - Authenticated Reflected Cross-Site Scripting

The id GET parameter used by WP Floating menu does not correctly sanitise user input before reflecting the parameter back to the user, resulting in a reflected XSS vulnerability. Other sanitisation have been added to prevent other XSS issues as well as potential SQL injections...

WordPress Admin Menu plugin <= 1.1 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by zerodetail & ratherbland WordPress Admin Menu plugin versions = 1.1. Solution Plugin closed. Deactivate and delete...

WP Admin Menu Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL. It is widely used internationally and can be compatible with self-developed plug-ins. Powerful and widely used. Cross-site scripting vulnerability...

CVE-2020-24316

WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...

CVE-2020-24316

WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...

CVE-2020-24316

WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...

CVE-2020-24316

CVE-2020-24316 affects the WordPress plugin Rednumber Admin Menu (versions 1.1 and lower). The vulnerability is a reflected XSS where the GET parameter role is echoed back without sanitization, enabling an attacker to craft a URL to execute client-side scripts. Exploitation is via a specially cra...

CVE-2020-24316: Improper Neutralization of Input During Web Page Generation

WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...