CVE-2021-25044

The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpwsetpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-25044

The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpwsetpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-25044 Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting

The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpwsetpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-25044

CVE-2021-25044 affects the WordPress plugin “Cryptocurrency Pricing list and Ticker” up to version 1.5. The vulnerability is a Reflected Cross‑Site Scripting (XSS) caused by the ccpw_setpage parameter not being properly sanitized/escaped before being echoed in shortcode pages. Exploitation would ...

WordPress plugin Cryptocurrency Pricing list and Ticker 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Cryptocurrency Pricing list and Ticker 1.5 and earlier versions have a cross-site scripting vulnerabilit...

PT-2022-9600 · WordPress · Cryptocurrency Pricing List/Ticker Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Cryptocurrency Pricing list and Ticker WordPress plugin versions prior to 1.5 Description: The issue arises from the plugin's failure to properly sanitise and escape the ccpw setpage parameter, leading to a Reflected Cross-Site Scripting issu...

WordPress AlgolPlus Advanced Dynamic Pricing for WooCommerce Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-38095

Cross-Site Request Forgery CSRF vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin = 4.1.3 at WordPress...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin = 4.1.3 at WordPress...

CVE-2022-38095

The CVE-2022-38095 entry concerns the WordPress plugin AlgolPlus Advanced Dynamic Pricing for WooCommerce (versions ≤ 4.1.3). Connected sources indicate a Cross-Site Request Forgery (CSRF) vulnerability arising from insufficient verification when updating settings, enabling actions authenticated ...

WordPress plugin AlgolPlus Advanced Dynamic Pricing for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2022-24198 · Woocommerce · Algolplus Advanced Dynamic Pricing For Woocommerce

Name of the Vulnerable Software and Affected Versions: AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin versions = 4.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

WordPress Cryptocurrency Pricing list and Ticker plugin <= 1.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Jeremie Amsellem in WordPress Cryptocurrency Pricing list and Ticker plugin versions = 1.5. Solution Deactivate and delete. This plugin has been closed as of September 8, 2022 and is not available for download. This closure is...

WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to plugin settings change discovered by Muhammad Daffa Patchstack Alliance in WordPress Advanced Dynamic Pricing for WooCommerce plugin versions = 4.1.3 Solution Update the WordPress Advanced Dynamic Pricing for WooCommerce plugin to the lates...

Advanced Dynamic Pricing for WooCommerce < 4.1.4 - Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

TWAP LP price manipulation

Lines of code Vulnerability details Impact The total value locked sum of the pair is used to price the LP. But the reserves of the underlying can be easily influenced by flashloan, then the TVL can vary dramatically.Just like what happened before here Warp. Although getPriceLP use TWAP to calcula...

CVE-2022-1057

The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

CVE-2022-1057

The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

CVE-2022-1057

The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

Sql injection

The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...