CVE-2021-24234

The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Ivory Search WordPress plugin versions prior to...

Better Search < 2.5.3 - CSRF Nonce Bypass in Import/Export

The plugin did not properly check the CSRF nonces when exporting and importing settings, allowing attackers to make a logged in user with the manageoptions capability export and import arbitrary settings by not providing the nonce parameter in the request POST...

WordPress Drug Search plugin <= 1.0.0 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by WPScan security research team in WordPress Drug Search plugin versions = 1.0.0. Solution 2020-02-15 - we were unable to find a patched version of this plugin. Notice from WordPress plugin repository: "This plugin has been closed as of January 14, 20...

Sql injection

The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation...

PT-2020-13036 · WordPress · Wp-Advanced-Search

Name of the Vulnerable Software and Affected Versions: wp-advanced-search plugin version 3.3.6 Description: The Import feature in the wp-advanced-search plugin is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any...

WordPress custom-search-plugin plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. custom-search-plugin is a custom search plugin used in it. A cross-site scripting vulnerability exists in WordPress custom-search-plug...

CVE-2017-18494

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues...

CVE-2017-18494

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues...

Cross site scripting

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues...

CVE-2017-18494

The CVE-2017-18494 issue affects the WordPress plugin custom-search-plugin prior to version 1.36 (BestWebSoft). The connected Nuclei template and related records confirm multiple XSS vulnerabilities in this plugin, enabling an attacker (with no special privileges) to inject and execute arbitrary ...

CVE-2017-18494

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues...

WordPress BP Profile Search Plugin <= 4.5.3 - PHP Object Injection

This plugin is prone to a PHP object injection vulnerability. Solution Update the plugin...

BP Profile Search <= 4.5.3 - PHP Object Injection

The plugin bp-profile-search insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. This vulnerability was patched in version 4.6, information is being released now as a disclosure period has expired...

Wordpress e-search plugin cross-site scripting vulnerability (CNVD-2016-09338)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. e-search is one of the search plug-ins. A cross-site scripting vulnerability exists in version 1.0 of the Wordpress...

Wordpress e-search plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. e-search is one of the search plug-ins. A cross-site scripting vulnerability exists in version 1.0 of the Wordpress...

CVE-2016-1000131

Reflected XSS in wordpress plugin e-search v1.0...

WordPress E-Search Plugin <= 1.0 - Cross-Site Scripting (XSS)

Because of this vulnerability, the variable date-from appears to send unsanitized data back to the users browser. Solution Update the plugin...

WordPress yolink Search Plugin <= 2.5 - Cross-Site Scripting

This plugin is prone to a cross site scripting vulnerability via "s" parameter. Solution Update the plugin...

CVE-2015-3361

Cross-site scripting XSS vulnerability in the Linkit module before 7.x-2.7 and 7.x-3.x before 7.x-3.3 for Drupal, when the node search plugin is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a node title...