WordPress plugin "WP Open Graph" vulnerable to cross-site request forgery

Overview WordPress plugin "WP Open Graph" provided by Custom4Web contains a cross-site request forgery vulnerability CWE-352. Koichi Kuriyama of Cryptography Laboratory,Department ofInformation and Communication Engineering,Tokyo Denki University directly reported this vulnerability to the...

JVN#33652328: WordPress plugin "WP Open Graph" vulnerable to cross-site request forgery

WordPress plugin "WP Open Graph" provided by Custom4Web contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin according to the information provided ...

WordPress WP Open Graph plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP Open Graph plugin is one of the plugins used to add Facebook metadata to web pages. A cross-site request forgery vulnerability exist...

@jamie452/open-graph-scraper (=2.3.2), bind-rest (>=1.4.0 <=1.4.6) +3 more potentially affected by CVE-2017-16098 via charset (>=0.0.1 <=1.0.0)

charset NPM version =0.0.1, =1.4.0, =2.2.2, =0.0.1, =0.1.0 Source cves: CVE-2017-16098 Source advisory: OSV:GHSA-9CP3-FH5X-XFCJ...

metascrape npm module cross-site scripting vulnerability

The metascrape npm module is a library for grabbing metadata from articles on the web. A cross-site scripting vulnerability in the metascrape npm module version 3.9.2 and earlier, which stems from the program's failure to filter HTML, can be exploited by a remote attacker to execute and inject...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

Cross site scripting

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

CVE-2018-3773

CVE-2018-3773 describes a stored XSS in Open Graph metadata read by the metascrape/metascraper npm tooling. Technical details across connected records show that the vulnerability affects metascrape versions up to 3.9.2 and metascraper versions up to 5.2.x (with Node advisories citing 5.3.0 as the...

CVE-2018-3773

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the metascrape npm module = 3.9.2...

PT-2018-16191 · Npm · Metascrape

Name of the Vulnerable Software and Affected Versions: metascraper versions prior to 5.2.0 metascrape npm module versions = 3.9.2 Description: The issue is related to a stored Cross-Site Scripting vulnerability in Open Graph meta properties. It affects the metascrape npm module and metascraper...

LinkedIn: Persistent XSS (unvalidated Open Graph embed) at LinkedIn.com

This report was previously published on Medium.com/@JonathanBouman. Follow me on Twitter or Medium for new reports. F361972 Proof of concept Background In my previous report we learned more about a special type of the persistent XSS attack; the unvalidated oEmbed attack. This attack allows us to...

Open Graph for Facebook, Google+ and Twitter Card Tags <= 2.2.4.1 - Unauthenticated Cross-Site Scripting (XSS)

The Open Graph and Twitter Card Tags WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability...

Open Graph for Facebook, Google+ and Twitter Card Tags <= 2.2.4.1 - Unauthenticated Cross-Site Scripting (XSS)

The Open Graph and Twitter Card Tags WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC...

WordPress Open Graph for Facebook, Google+ and Twitter Card Tags plugin <= 2.2.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress Open Graph for Facebook, Google+ and Twitter Card Tags plugin versions = 2.2.4. Solution Update the WordPress Open Graph for Facebook, Google+ and Twitter Card Tags plugin to the latest available version at least...

Open Graph for Facebook, Google+ and Twitter Card Tags <= 2.2.4 - Authenticated Reflected XSS

There is a reflected XSS vulnerability caused by "Open Graph for Facebook, Google+ and Twitter Card Tags" in the wdfbogerror parameter on a GET request when editing a post. This can be exploited by tricking an authenticated Wordpress administrator into clicking a malicious link. This vulnerabilit...

CVE-2016-10569

embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

CVE-2016-10569

embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...

CVE-2016-10569

The CVE-2016-10569 issue affects the embedza module prior to version 1.2.4, where JavaScript resources are downloaded over HTTP. This enables a man-in-the-middle scenario where an attacker on the network could swap the requested JavaScript with a malicious file, potentially leading to remote code...

WordPress Open Graph for Facebook, Google+ and Twitter Card Tags Plugin < 2.2.4.1 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112287";...