5386 matches found
CVE-2024-8983
Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-8983 Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS
Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-8983
The Custom Twitter Feeds WordPress plugin (also known as Tweets Widget) is vulnerable to a Stored Cross-Site Scripting (XSS) attack in versions before 2.2.3 . The root cause is the failure to sanitize and escape certain settings, which allows high-privilege users, such as administrators, to injec...
PT-2024-39351
Name of the Vulnerable Software and Affected Versions: Custom Twitter Feeds WordPress plugin versions prior to 2.2.3 Description: The issue allows high privilege users to inject scripts due to the plugin not filtering some of its settings. Recommendations: For versions prior to 2.2.3, update to...
Veertu Anka Build 安全漏洞
Veertu Anka Build is a centralized dashboard from Veertu. A security vulnerability exists in Veertu Anka Build version 1.42.0, which stems from an unexpected privilege escalation during a node agent update where a user with low privileges can trigger the update action...
CVE-2024-3635
The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-3635 The Post Grid < 7.5.0 - Editor+ Stored XSS via Grid Creation
The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-3635: Improper Neutralization of Input During Web Page Generation
The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2024-26959 · WordPress · Post Grid
Name of the Vulnerable Software and Affected Versions: The Post Grid WordPress plugin versions prior to 7.5.0 Description: The issue allows high privilege users, such as Editor and above, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...
CVE-2024-6517
The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users...
CVE-2024-6517
The CVE concerns the WordPress plugin Contact Form 7 Math Captcha, affected versions
CVE-2024-6517: Improper Neutralization of Input During Web Page Generation
The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users...
CVE-2024-7878 WP ULike < 4.7.4 - Admin+ Stored XSS
The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-8758
CVE-2024-8758 affects the Quiz and Survey Master (QSM) WordPress plugin prior to version 9.1.3. The issue is stored XSS caused by insufficient sanitization/escaping of settings, potentially allowing high-privilege users (e.g., admins) to inject scripts even when unfiltered_html is disallowed (e.g...
CVE-2024-6850
The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2024-6850
The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2024-6850 Carousel Slider < 2.2.14 - Editor+ Stored XSS
The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2024-6850 Carousel Slider < 2.2.14 - Editor+ Stored XSS
The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2024-6850
The CVE-2024-6850 entry concerns the Carousel Slider WordPress plugin prior to version 2.2.4. The affected component is the plugin’s settings handling, which does not adequately sanitise/escape certain settings, enabling Cross-Site Scripting by high-privilege users (e.g., editors). The advisory d...