Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX < 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

PostX < 4.0.2 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks 1. Create a new Post and add "Ultimate post...

PostX < 4.0.2 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC 1. Create a new Post and add "Ultimate...

CVE-2024-32564 WordPress Post Grid Blocks and WordPress News Plugin – PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Post Grid Team by WPXPO PostX – Gutenberg Blocks for Post Grid allows Stored XSS.This issue affects PostX – Gutenberg Blocks for Post Grid: from n/a through 4.0.1...

CVE-2024-32564 WordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through = 4.0.1...

CVE-2024-32564

CVE-2024-32564 affects Post Grid Gutenberg Blocks and PostX (Post Grid for WordPress) with a Stored XSS in Post Grid blocks (improper input neutralization during page generation). Affected versions: PostX – Gutenberg Blocks for Post Grid up to 4.0.1. Root cause: improper neutralization of input; ...

WordPress Plugin PostX 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site...

PT-2024-24685 · WordPress · Postx – Gutenberg Blocks For Post Grid

Name of the Vulnerable Software and Affected Versions: PostX – Gutenberg Blocks for Post Grid versions through 4.0.1 Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS. Recommendations: F...

WordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by CatFather in WordPress Plugin PostX versions = 4.0.1...

WordPress PostX Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

Software PostX Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2024-32564 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 904b17651379 Credits CatFather Required privilege...

PostX – Gutenberg Blocks for Post Grid < 3.2.4 - Incorrect Authorization

Description The PostX – Gutenberg Blocks for Post Grid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with author-level access an...

WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerability

Author+ Post/Page Duplication vulnerability discovered by movrment in WordPress Plugin PostX versions = 3.2.3...

WordPress PostX Plugin <= 3.2.3 is vulnerable to Broken Access Control

Software PostX Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31246 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 28b8452ef2a5 Credits movrment Required privilege Author...

CVE-2023-3992

The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Cross site scripting

The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-3992 PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting

The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-3992 PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site Scripting

The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-3992

CVE-2023-3992 affects the PostX – Gutenberg Post Grid Blocks plugin for WordPress v3.0.6 and earlier. The issue is a Reflected Cross-Site Scripting (XSS) caused by insufficient sanitisation/escaping of a parameter before it is echoed on the page, potentially impacting high-privilege users such as...

PT-2023-27155 · WordPress · Postx

Name of the Vulnerable Software and Affected Versions: PostX WordPress plugin versions prior to 3.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

WordPress plugin PostX 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists...