CVE-2022-1409

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code...

Cross site scripting

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

Cross site scripting

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

Cross site scripting

The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

Code injection

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code...

CVE-2022-0873: Improper Neutralization of Input During Web Page Generation

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is...

CVE-2022-1062: Improper Neutralization of Input During Web Page Generation

The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-13626

Name of the Vulnerable Software and Affected Versions th23 Social WordPress plugin versions prior to 1.2.1 Description The issue concerns the th23 Social WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

CVE-2022-1435: Improper Neutralization of Input During Web Page Generation

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2022-13887

Name of the Vulnerable Software and Affected Versions WPCargo Track & Trace WordPress plugin versions prior to 6.9.5 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not sanitizin...

CVE-2022-1512: Improper Neutralization of Input During Web Page Generation

The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1334: Improper Neutralization of Input During Web Page Generation

The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2022-9673

Name of the Vulnerable Software and Affected Versions AGIL WordPress plugin versions 1.0 and earlier Description The issue allows high-privilege users, such as admins, to upload arbitrary files, including PHP files, by accepting all zip files without validating the extracted file type, leading to...

PT-2022-13866

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.5.8 Description The issue allows high privilege users, such as administrators, to upload PHP files disguised as images, which can contain malicious PHP code, due to...

PT-2022-13865

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS WordPress plugin versions prior to 1.5.8 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly...

PT-2022-13490

Name of the Vulnerable Software and Affected Versions Gmedia Photo Gallery WordPress plugin versions prior to 1.20.0 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the Album's name is not properly sanitised and...

CVE-2022-1408: Improper Neutralization of Input During Web Page Generation

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2022-13807

Name of the Vulnerable Software and Affected Versions WP YouTube Live WordPress plugin versions prior to 1.8.3 Description The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly validate, sanitize, and...

GHSA-WJ5C-J656-H5FW Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

In Jenkins before versions 2.44 and 2.32.2, node monitor data could be viewed by low privilege users via the remote API. These included system configuration and runtime information of these nodes SECURITY-343...

GHSA-M93H-5QMX-PPHG Improper Authentication in Jenkins

In Jenkins before versions 2.44 and 2.32.2, low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks SECURITY-371...