UBUNTU-CVE-2022-4973

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into...

CVE-2023-5352 Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply

The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpaseditreply function, allowing users to edit posts for which they do not have permission...

CVE-2023-5352

The CVE-2023-5352 entry relates to the WordPress plugin Awesome Support prior to version 6.1.5, where an insufficient authorization check in the wpas_edit_reply function allows a user to edit posts for which they lack permission. Affected versions are prior to 6.1.5; the issue is documented with ...

CVE-2022-46890

Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum this is caused by a lack of checks performed by the /forums.php?action=post page...

CVE-2022-24664: Improper Control of Generation of Code

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts...

GHSA-PPQ7-88C7-Q879 Cross-Site Request Forgery in PiranhaCMS

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery CSRF when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known...

CVE-2021-24743

The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS...

WordPress Related Posts 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Related Posts is a plugin for adding related content to WordPress. A cross-site scripting vulnerability exists in the Related...

PT-2021-15726

Name of the Vulnerable Software and Affected Versions: Related Posts for WordPress versions prior to 2.0.4 Description: The issue arises from unvalidated input and a lack of output encoding within the plugin, leading to a Reflected Cross-Site Scripting XSS vulnerability. This vulnerability is...

CVE-2021-24180: Improper Neutralization of Input During Web Page Generation

Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting XSS vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious UR...

Mblog Cross-Site Scripting Vulnerability (CNVD-2021-26163)

Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5 has a cross-site scripting vulnerability , the vulnerability stems from post editing via the post content field . An attacker can use this vulnerability to inject arbitrary Web script or HT...

CVE-2020-19618

Cross Site Scripting XSS vulnerability in mblog 3.5 via the post content field to /post/editing...

CVE-2020-19616

Cross Site Scripting XSS vulnerability in mblog 3.5 via the post header field to /post/editing...

CVE-2020-19616

Cross Site Scripting XSS vulnerability in mblog 3.5 via the post header field to /post/editing...

Cross site scripting

Cross Site Scripting XSS vulnerability in mblog 3.5 via the post header field to /post/editing...

CVE-2020-19618

Cross Site Scripting XSS vulnerability in mblog 3.5 via the post content field to /post/editing...

CVE-2020-19616

Cross Site Scripting XSS vulnerability in mblog 3.5 via the post header field to /post/editing...

CVE-2020-19616

CVE-2020-19616 concerns a Cross-Site Scripting (XSS) vulnerability in the open-source Java blog system mblog, reported for version 3.5.0. The flaw is triggered via the post header field when editing a post, specifically through the /post/editing endpoint. The connected sources corroborate the iss...

PT-2021-10376

Name of the Vulnerable Software and Affected Versions: mblog version 3.5 Description: A Cross Site Scripting XSS issue exists, allowing attackers to inject malicious scripts via the post content field to the "/post/editing" API endpoint. Recommendations: For mblog version 3.5, update the post...

langhsu mblog 跨站脚本漏洞

Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5 has a cross-site scripting vulnerability , the vulnerability stems from post editing via the post content field . An attacker can use this vulnerability to inject arbitrary Web script or HT...