1478 matches found
Prototype Pollution
dset is vulnerable to Prototype Pollution. The vulnerability is due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program...
PT-2024-38637 · WordPress · Simple Headline Rotator
Name of the Vulnerable Software and Affected Versions: The Simple Headline Rotator WordPress plugin version 1.0 Description: The issue is related to the lack of CSRF checks in some places, as well as missing sanitization and escaping, which could allow attackers to make logged-in admins add Store...
WordPress plugin Opti Marketing 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
CVE-2024-6792
Vulnerability context: CVE-2024-6792 affects the WP ULike WordPress plugin prior to 4.7.2.1. The issue stems from improper sanitization of user display names when rendering on public pages, which is described in Red Hat and Patchstack entries as a subscriber-level stored XSS exposure. Affected so...
CVE-2024-8318
The CVE-2024-8318 entry relates to the WordPress Attributes for Blocks plugin (≤1.0.6). It implements a Stored XSS via the attributesForBlocks parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor+ access to inject scripts that exe...
PT-2024-37812 · WordPress · Reglevel
Name of the Vulnerable Software and Affected Versions: RegLevel plugin for WordPress versions up to, and including, 1.2.1 Description: The issue allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages due to insufficient input...
PT-2024-35371 · WordPress · Ultimate Addons For Wpbakery
Name of the Vulnerable Software and Affected Versions: The Ultimate Addons for WPBakery plugin for WordPress versions up to, and including, 3.19.20 Description: The issue is related to Stored Cross-Site Scripting via the plugin's ultimate dual color shortcode due to insufficient input sanitizatio...
CVE-2024-5002
The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
GHSA-9MVJ-F7W8-PVH2 Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability
Withdrawn Advisory This advisory has been withdrawn because it was determined to not be a vulnerability in Bootstrap. From the CVE: This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior...
GHSA-52JW-F3JQ-HHWG Duplicate Advisory: Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6p7-44rh-m3rr. This link has been maintained to preserve external references. Original Description The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter...
CVE-2024-2122
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
PT-2024-27638 · WordPress · Alemha Watermarker
Name of the Vulnerable Software and Affected Versions: Alemha watermarker WordPress plugin versions 1.3.1 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...
PT-2024-35615
Name of the Vulnerable Software and Affected Versions The Newsletter plugin for WordPress versions up to, and including, 8.3.4 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to injec...
PT-2024-35749 · WordPress · Happy Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.9 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, specifically the arrow attribute within...
PT-2024-19471 · WordPress · Testimonial Carousel For Elementor
Name of the Vulnerable Software and Affected Versions: Testimonial Carousel For Elementor plugin for WordPress versions up to, and including, 10.2.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's carousel widgets,...
Basecamp: Stored XSS on trix editor version 2.1.1
The Trix editor version 2.1.1 was vulnerable to stored cross-site scripting XSS attacks. The vulnerability was caused by improper sanitization of content pasted into the editor, allowing an attacker to embed malicious scripts that were executed within the context of the application...
CVE-2024-4484 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘xaiusername’ parameter in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escapin...
PT-2024-40130 · Drupal · Drupal Core
Name of the Vulnerable Software and Affected Versions: Drupal core affected versions not specified Description: The issue is related to the sanitization of variables for shell arguments in the DefaultMailSystem::mail function when sending email, which could potentially lead to remote code...
CVE-2024-4630
The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customuploadmimes’ function in versions up to, and including, 4.2.0 due to insufficient input sanitization and output escaping. This makes it possible...