CVE-2021-4208

The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the productid POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users...

Sql injection

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection...

Sql injection

The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the productid POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users...

PT-2022-11541

Name of the Vulnerable Software and Affected Versions ExportFeed WordPress plugin versions prior to 2.0.1.0 Description The issue arises from the lack of sanitization and escaping of the product id POST parameter, which is then used in a SQL statement. This leads to a SQL injection issue that can...

CVE-2021-4208: Improper Neutralization of Special Elements used in an SQL Command

The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the productid POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users...

CVE-2021-25050

The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24904: Improper Neutralization of Input During Web Page Generation

The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25109: Improper Neutralization of Special Elements used in an SQL Command

The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting XSS against logged in admins by making send open a malicious link...

CVE-2021-25050: Improper Neutralization of Input During Web Page Generation

The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Go to "Field Editor" page. Put the following XSS payload into the "Placeholder /...

CVE-2022-21660 Missing authorization in gin-vue-admin

Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the setUserInfo function. Users are advised to update as soon as possible. There are no known workarounds...

CVE-2022-21703: Cross-Site Request Forgery (CSRF)

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users for example,...

CVE-2021-25029

The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25029 Cluevo < 1.8.1 - Admin+ Stored Cross Site Scripting

The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25105: Improper Neutralization of Input During Web Page Generation

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25029: Improper Neutralization of Input During Web Page Generation

The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-9586

Name of the Vulnerable Software and Affected Versions CLUEVO LMS, E-Learning Platform WordPress plugin versions prior to 1.8.1 Description The issue concerns the lack of sanitization and escaping of Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks ev...

PT-2022-9660

Name of the Vulnerable Software and Affected Versions Ivory Search WordPress plugin versions prior to 5.4.1 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of proper escaping in some Form settings, even when the unfiltered html capability ...

CP Blocks < 1.0.15 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed. PoC Put the following payloads in the "License ID" setting of the plugin and save: "...