CVE-2022-2194: Improper Neutralization of Input During Web Page Generation

The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-2148: Improper Neutralization of Input During Web Page Generation

The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-2118: Improper Neutralization of Input During Web Page Generation

The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-14968

Name of the Vulnerable Software and Affected Versions The Very Simple Breadcrumb WordPress plugin through 1.0 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings. This is possible...

PT-2022-14964

Name of the Vulnerable Software and Affected Versions The LinkedIn Company Updates WordPress plugin versions 1.5.3 and earlier Description The issue allows high privilege users, such as admin, to perform cross-Site Scripting attacks due to the plugin not sanitising and escaping its settings. This...

PT-2022-14858

Name of the Vulnerable Software and Affected Versions The Page Generator WordPress plugin versions prior to 1.6.5 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings, even when the...

PT-2022-15041

Name of the Vulnerable Software and Affected Versions The Loading Page with Loading Screen WordPress plugin versions prior to 1.0.83 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the plugin not escaping its settings. This can occ...

PT-2022-15170

Name of the Vulnerable Software and Affected Versions The Simple Post Notes WordPress plugin versions prior to 1.7.6 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the lack of sanitization and escaping of its settings. This can...

CVE-2022-2186: Improper Neutralization of Input During Web Page Generation

The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-14872

Name of the Vulnerable Software and Affected Versions The Data Tables Generator by Supsystic WordPress plugin versions prior to 1.10.20 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is...

PT-2022-15193

Name of the Vulnerable Software and Affected Versions Accept Stripe Payments WordPress plugin versions prior to 2.0.64 Description The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks due to the plugin's failure to sanitize and escape some of its settings...

SAP S/4HANA Licensing Issue Vulnerability

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP Germany. SAP S/4HANA is vulnerable to an authorization issue that stems from the application business partner extension component not performing the required authorization checks for...

SAP S/4HANA security vulnerabilities

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP Germany. SAP S/4HANA is vulnerable to an authorization issue that stems from the application business partner extension component not performing the required authorization checks for...

GiveWP < 2.21.0 - Manager+ Arbitrary File Creation via Export

The plugin does not validate the exported file, which could allow high privilege users such as Managers to create arbitrary files...

CVE-2022-2093

The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2022-14849

Name of the Vulnerable Software and Affected Versions Bold Page Builder WordPress plugin versions prior to 4.3.3 Description The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to perform Cross-Site...

CVE-2022-2050: Improper Neutralization of Input During Web Page Generation

The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when unfilteredhtml is disallowed...

CVE-2022-1894: Improper Neutralization of Input During Web Page Generation

The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltredhtml is disallowed...

PT-2022-14712

Name of the Vulnerable Software and Affected Versions WP-Paginate WordPress plugin versions prior to 2.1.9 Description The issue allows high privilege users to perform Stored Cross-Site Scripting attacks when unfiltered html is disallowed, due to the plugin not escaping one of its settings...

CVE-2022-24138

IOBit Advanced System Care Asc.exe 15 and Action Download Center both download components of IOBit suite into ProgramData folder, ProgramData folder has "rwx" permissions for unprivileged users. Low privilege users can use SetOpLock to wait for CreateProcess and switch the genuine component with ...