PT-2022-14968

Name of the Vulnerable Software and Affected Versions The Very Simple Breadcrumb WordPress plugin through 1.0 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings. This is possible...

CVE-2022-2118: Improper Neutralization of Input During Web Page Generation

The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-2148: Improper Neutralization of Input During Web Page Generation

The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-15041

Name of the Vulnerable Software and Affected Versions The Loading Page with Loading Screen WordPress plugin versions prior to 1.0.83 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the plugin not escaping its settings. This can occ...

CVE-2022-2169: Improper Neutralization of Input During Web Page Generation

The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

SAP S/4HANA Licensing Issue Vulnerability

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP Germany. SAP S/4HANA is vulnerable to an authorization issue that stems from the application business partner extension component not performing the required authorization checks for...

GiveWP < 2.21.0 - Manager+ Arbitrary File Creation via Export

The plugin does not validate the exported file, which could allow high privilege users such as Managers to create arbitrary files...

SAP S/4HANA 安全漏洞

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP Germany. SAP S/4HANA is vulnerable to an authorization issue that stems from the application business partner extension component not performing the required authorization checks for...

CVE-2022-2093

The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2022-14712

Name of the Vulnerable Software and Affected Versions WP-Paginate WordPress plugin versions prior to 2.1.9 Description The issue allows high privilege users to perform Stored Cross-Site Scripting attacks when unfiltered html is disallowed, due to the plugin not escaping one of its settings...

PT-2022-14849

Name of the Vulnerable Software and Affected Versions Bold Page Builder WordPress plugin versions prior to 4.3.3 Description The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to perform Cross-Site...

CVE-2022-1894: Improper Neutralization of Input During Web Page Generation

The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltredhtml is disallowed...

CVE-2022-2050: Improper Neutralization of Input During Web Page Generation

The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when unfilteredhtml is disallowed...

CVE-2022-24138

IOBit Advanced System Care Asc.exe 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with ...

WordPress Popup <= 1.9.3.8 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup PoC On...

CVE-2021-25056

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-9612

Name of the Vulnerable Software and Affected Versions Ninja Forms Contact Form WordPress plugin versions prior to 3.6.10 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of field labels, even when the unfiltered...

PT-2022-9622

Name of the Vulnerable Software and Affected Versions Ninja Forms Contact Form WordPress plugin versions prior to 3.6.10 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some imported data, even when the...

CVE-2021-25056: Improper Neutralization of Input During Web Page Generation

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...