CVE-2022-23981 WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerability

The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin versions = 2.0.4...

CVE-2022-23981 WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerability

The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin versions = 2.0.4...

CVE-2022-23981

CVE-2022-23981 affects WordPress Perfect Brands for WooCommerce plugin. Versions up to and including 2.0.4 expose an access control flaw where Subscriber+ level users can create brands due to missing authorization/CSRF checks in AJAX actions. The issue enables arbitrary brand creation by low-priv...

WordPress Plugin信息泄露漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. WordPress plugin is a WordPress application plugin. WordPress Plugin Perfect Brands for WooCommerce is vulnerable to an information disclosure vulnerability that could be exploited by an attacker...

WordPress Perfect Survey plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress Perfect Survey plugin in versions prior to 1.5.2 has a cross-site request forgery vulnerability, which stems from the absence of CSRF in the saveglobalsetting AJAX action check, an...

WordPress Perfect Survey plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. WordPress Perfect Survey plugin in version 1.5.2 and prior versions suffers from a cross-site scripting vulnerability that stems from not validating and escaping the X-Forwarded-For header value,...

WordPress Perfect Survey插件SQL注入漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language.The WordPress Perfect Survey plugin has a SQL injection vulnerability in versions prior to 1.5.2, which stems from the lack of validation of externally entered SQL statements in database-based...

CVE-2021-24765

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

CVE-2021-24764

The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters id and filterssessionid of singlestatistics page, type and message of importexport page before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripti...

CVE-2021-24762

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

CVE-2021-24762

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

CVE-2021-24765

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

Sql injection

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

Cross site scripting

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...

CVE-2021-24765

The CVE-2021-24765 issue affects the WordPress Perfect Survey plugin up to version 1.5.2. The root cause is failure to validate/escape the X-Forwarded-For header when Anonymize IP is off, allowing Stored Cross-Site Scripting on the statistic page. Affected component: the plugin’s statistic page r...

CVE-2021-24764

The CVE-2021-24764 issue affects the Perfect Survey WordPress plugin prior to version 1.5.2. The vulnerability stems from insufficient sanitisation/escaping of user-supplied input in admin pages: id and filters[session_id] on the single_statistics page, and type and message on the importexport pa...

CVE-2021-24763

CVE-2021-24763 affects the WordPress Perfect Survey plugin prior to 1.5.2. The issue is an unauthorised AJAX path (save_global_setting) lacking proper authorisation/CSRF checks, allowing unauthenticated users to edit surveys and settings. Due to insufficient sanitisation/escaping, this can enable...

CVE-2021-24762

CVE-2021-24762 affects WordPress Perfect Survey plugin versions before 1.5.2. The get_question AJAX action does not validate/escape the question_id parameter, enabling unauthenticated SQL injection. Consequences can include unauthorized access to data and potential compromise of the database. Rem...

CVE-2021-24762 Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

WordPress pluginSQL注入漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language.The WordPress Perfect Survey plugin has a SQL injection vulnerability in versions prior to 1.5.2, which stems from the lack of validation of externally entered SQL statements in database-based...