WordPress Name Directory Plugin <= 1.27.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Name Directory Type Plugin Vulnerable versions = 1.27.1 Fixed in 1.27.2 OWASP Top 10 A6: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-22692 Patch priority Low CVSS severity Low 4.3 Developer Jeroen Peters PSID 97cd32d13c24 Credits NeginNrb Require...

WordPress plugin Name Directory跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Name Directory versions prior to 1.25.4 are vulnerable to cross-site request forgery, which...

CVE-2022-2071

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them...

CVE-2022-2072

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...

CVE-2022-2072

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...

CVE-2022-2071

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them...

CVE-2022-2072

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...

Cross site scripting

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...

CVE-2022-2072

CVE-2022-2072 affects the WordPress Name Directory plugin prior to 1.25.3. The vulnerability arises from insufficient sanitization/escaping of a parameter output back to the page, causing both Reflected and Stored XSS (payloads are saved to the database after the request). Connected sources confi...

CVE-2022-2072 Name Directory < 1.25.3 - Reflected Cross-Site Scripting

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...

CVE-2022-2071

CVE-2022-2071 affects the WordPress Name Directory plugin (versions prior to 1.25.4). The root cause is missing CSRF checks and insufficient sanitisation/escaping in imported data, enabling a logged-in admin to import names containing XSS payloads (stored XSS). Exploitation details in connected s...

CVE-2022-2071: Cross-Site Request Forgery (CSRF)

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them...

CVE-2022-2072: Improper Neutralization of Input During Web Page Generation

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well...

PT-2022-14837

Name of the Vulnerable Software and Affected Versions The Name Directory WordPress plugin versions prior to 1.25.4 Description The issue concerns a lack of CSRF check when importing names and inadequate sanitisation and escaping of imported data. This could allow attackers to make a logged-in adm...

WordPress plugin Name Directory 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Name Directory versions prior to 1.25.4 are vulnerable to cross-site request forgery, which...

WordPress plugin Name Directory 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

PT-2022-14838

Name of the Vulnerable Software and Affected Versions The Name Directory WordPress plugin versions prior to 1.25.3 Description The issue is related to a Reflected Cross-Site Scripting and a Stored XSS. This occurs because a parameter is not properly sanitised and escaped before being outputted ba...

WordPress Name Directory plugin <= 1.25.4 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress Name Directory plugin versions = 1.25.4. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.25.5...

Name Directory < 1.25.5 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check when adding/editing names, and is also lacking sanitisation as well as escaping in some of the fields, which could allow attackers to make a logged in admin edit arbitrary names and put XSS payloads in them. ' / " / ' /...

WordPress Name Directory plugin <= 1.25.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Donato Di Pasquale in WordPress Name Directory plugin versions = 1.25.2. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.25.3...