4578 matches found
CVE-2022-4369 WP-Lister Lite for Amazon < 2.4.4 - Reflected XSS
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin...
CVE-2022-4369 WP-Lister Lite for Amazon < 2.4.4 - Reflected XSS
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin...
CVE-2022-4358
The CVE-2022-4358 entry concerns the WP RSS By Publishers WordPress plugin (version
CVE-2022-3936 Team Members < 5.2.1 - Editor+ Stored XSS
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in a multisite setup...
CVE-2022-3936 Team Members < 5.2.1 - Editor+ Stored XSS
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in a multisite setup...
CVE-2022-4355 LetsRecover < 1.2.0 - Admin+ SQLi
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-4355 LetsRecover < 1.2.0 - Admin+ SQLi
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-4302 White Label CMS < 2.5 - Admin+ PHP Object Injection
The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...
CVE-2022-4360 WP RSS By Publishers <= 0.1 - Admin+ SQLi
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-4351 Qe SEO Handyman <= 1.0 - Admin+ SQLi
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2022-4371 Web Invoice <= 2.1.3 - Authenticated SQLi
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as...
PT-2023-14060 · WordPress · Login With Cognito
Name of the Vulnerable Software and Affected Versions: Login with Cognito WordPress plugin versions 1.4.8 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...
PT-2023-14267 · WordPress · Wp Rss By Publishers
Name of the Vulnerable Software and Affected Versions: WP RSS By Publishers WordPress plugin version 0.1 Description: The issue is related to a SQL injection that occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement. This can be exploited by high...
PT-2023-13721 · WordPress · Team Members
Name of the Vulnerable Software and Affected Versions: The Team Members WordPress plugin versions prior to 5.2.1 Description: The issue allows high-privilege users, such as editors, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example...
PT-2023-14287 · WordPress · Wp-Lister Lite For Amazon
Name of the Vulnerable Software and Affected Versions: WP-Lister Lite for Amazon WordPress plugin versions prior to 2.4.4 Description: The issue is related to a Reflected Cross-Site Scripting that can be used against high-privilege users such as admin. This occurs because the plugin does not...
PT-2023-14170 · WordPress · White Label Cms
Name of the Vulnerable Software and Affected Versions: White Label CMS WordPress plugin versions prior to 2.5 Description: The issue allows high-privilege users, such as admins, to perform PHP Object Injection when a suitable gadget is present. This is due to the plugin unserializing user input...
PT-2023-14265 · WordPress · Wp Rss By Publishers
Name of the Vulnerable Software and Affected Versions: WP RSS By Publishers WordPress plugin version 0.1 Description: The issue is related to a SQL injection that occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement. This can be exploited by high...
PT-2023-14259 · WordPress · Wp Rss By Publishers
Name of the Vulnerable Software and Affected Versions: WP RSS By Publishers WordPress plugin version 0.1 Description: The issue is related to a SQL injection that occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement. This can be exploited by high...
PT-2023-14230 · WordPress · Qe Seo Handyman Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: Qe SEO Handyman WordPress plugin versions 1.0 and earlier Description: The issue arises from the plugin's failure to properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploite...
