CVE-2023-46618 WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...

CVE-2023-46618

CVE-2023-46618 is a CSRF vulnerability affecting WordPress Category SEO Meta Tags plugin versions

CVE-2023-46618: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...

PT-2023-30115 · WordPress · Category Seo Meta Tags

Name of the Vulnerable Software and Affected Versions: Category SEO Meta Tags plugin versions = 2.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

The vulnerabilities of the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions of the WordPress Content Management Plugin, Post Meta Data Manager, allow a malicious user to delete arbitrary user metadata.

The vulnerabilities of the pmdmwpdeleteusermeta, pmdmwpdeletetermmeta, and pmdmwpajaxdeletemeta functions of the WordPress Content Management Plugin, Post Meta Data Manager, are related to incorrect authentication procedures. Exploiting these vulnerabilities could allow a malicious actor to...

The vulnerabilities of the `pmdm_wp_change_user_meta` and `pmdm_wp_change_post_meta` functions in the Post Meta Data Manager plugin for the WordPress content management system allow a hacker to increase their privileges.

The vulnerability of the pmdmwpchangeusermeta and pmdmwpchangepostmeta functions in the Post Meta Data Manager plugin for the WordPress content management system is related to an incorrect authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileg...

CVE-2023-5669

The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, and including, 0.8.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5669: Improper Neutralization of Input During Web Page Generation

The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, and including, 0.8.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Rocky Linux 8 : thunderbird (RLSA-2022:6708)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:6708 advisory. - When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specifi...

Simple Social Buttons < 5.1.1 - Unauthenticated Password Protected Post Access

Description The plugin leaks password-protected post content to unauthenticated visitors in some meta tags PoC As unauthenticated, view the source of any password-protected post and see that the content of the post is disclosed in the og:description and twitter:description meta tags...

CVE-2023-5707

The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5707: Improper Neutralization of Input During Web Page Generation

The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Plugin SEO Slider Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin SEO Slider 1.1.0 and...

WP Simple Galleries <= 1.34 - Contributor+ PHP Object Injection

Description The plugin does not properly handle deserialization of untrusted input from the 'wpsimplegallerygallery' post meta via 'wpsgallery' shortcode...

Cross site scripting

The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change...

CVE-2023-4823

CVE-2023-4823 affects the WordPress plugin “WP Meta and Date Remover” (versions prior to 2.2.0). The vulnerability arises from an AJAX endpoint used to configure plugin settings that lacks capability checks and does not sanitize user input, with the input later output unescaped. This enables Stor...

Meta Launches Paid Ad-Free Subscription in Europe to Satisfy Privacy Laws

Meta on Monday announced plans to offer an ad-free option to access Facebook and Instagram for users in the European Union EU, European Economic Area EEA, and Switzerland to comply with "evolving" data protection regulations in the region. The ad-free subscription, which costs €9.99/month on the...

PT-2023-30746 · WordPress · Wp Meta/Date Remover

Name of the Vulnerable Software and Affected Versions: WP Meta and Date Remover WordPress plugin versions prior to 2.2.0 Description: The issue concerns an AJAX endpoint for configuring plugin settings that lacks capability checks and fails to sanitize user input. This input is later output...

CVE-2023-4823: Improper Neutralization of Input During Web Page Generation

The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change...

WordPress Plugin WP Meta and Date Remover Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...