PT-2023-32195 · WordPress · Wp Simple Galleries

Name of the Vulnerable Software and Affected Versions: WP Simple Galleries plugin for WordPress versions up to, and including, 1.34 Description: The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input from the wpsimplegallery galle...

CVE-2023-5426

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdmwpdeleteusermeta, pmdmwpdeletetermmeta, and pmdmwpajaxdeletemeta functions in versions up to, and including, 1.2.0. This makes it possible for...

CVE-2023-5425

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdmwpchangeusermeta and pmdmwpchangepostmeta functions in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with...

Design/Logic Flaw

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdmwpdeleteusermeta, pmdmwpdeletetermmeta, and pmdmwpajaxdeletemeta functions in versions up to, and including, 1.2.0. This makes it possible for...

CVE-2023-5426

CVE-2023-5426 affects the WordPress plugin Post Meta Data Manager (versions ≤ 1.2.0). A missing capability check in functions pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta allows unauthenticated attackers to delete user, term, and post meta belonging to arbitrar...

CVE-2023-5426 Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdmwpdeleteusermeta, pmdmwpdeletetermmeta, and pmdmwpajaxdeletemeta functions in versions up to, and including, 1.2.0. This makes it possible for...

WordPress plugin Post Meta Data Manager security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress plugin Post Meta Data Manager security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-5426: Missing Authorization

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdmwpdeleteusermeta, pmdmwpdeletetermmeta, and pmdmwpajaxdeletemeta functions in versions up to, and including, 1.2.0. This makes it possible for...

CVE-2023-5425: Missing Authorization

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdmwpchangeusermeta and pmdmwpchangepostmeta functions in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with...

CVE-2023-46091

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...

CVE-2023-46091

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...

CVE-2023-46091 WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...

CVE-2023-46091 WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...

CVE-2023-46091

CVE-2023-46091 concerns the WordPress plugin Category SEO Meta Tags by Bala Krishna / Sergey Yakovlev. The initial document states an Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability affecting the plugin versions &lt;= 2.5 . Publicly available connected details confirm the component...

CVE-2023-46091: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin = 2.5 versions...

Category SEO Meta Tags <= 2.5 - Admin+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Post Meta Data Manager Plugin <= 1.2.0 is vulnerable to Broken Access Control

Software Post Meta Data Manager Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5426 Patch priority Medium CVSS severity Medium 7.5 Developer Claim ownership PSID a003d34ca1b2 Credits Francesco Carlucc...

PT-2023-29841 · WordPress · Category Seo Meta Tags

Name of the Vulnerable Software and Affected Versions: Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin versions prior to 2.6 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability...

PT-2023-6744 · WordPress · Post Meta Data Manager

Name of the Vulnerable Software and Affected Versions: Post Meta Data Manager plugin for WordPress version 1.2.0 and earlier Description: The issue is related to a missing capability check on the pmdm wp change user meta and pmdm wp change post meta functions. This allows authenticated attackers...