CVE-2023-5126

The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugindeleteme' shortcode in versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-45644

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin = 1.0 versions...

CVE-2023-45644

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin = 1.0 versions...

Delete Me < 3.1 - Contributor+ Stored Cross-Site Scripting via Shortcode

Description The plugin does not validate and escape some of its attributes for the plugindeleteme shortcode before outputting them back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against...

WP Font Awesome <= 1.7.9 - Contributor+ Stored Cross-Site Scripting via Shortcode

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admi...

WordPress Plugin CPT Shortcode Generator Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

BSK PDF Manager < 3.4.2 - Contributor+ Stored XSS via Shortcode

Description The plugin does not validate and escape some of its attributes for the bsk-pdfm-category-dropdown shortcode before outputting them back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used agains...

CVE-2023-5127 WP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible for authenticated attackers with...

CVE-2023-5745 Reusable Text Blocks <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode

The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-45644 WordPress CPT Shortcode Generator Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin = 1.0 versions...

CVE-2023-45644

CVE-2023-45644: Authenticated (admin+) Stored Cross-Site Scripting in the CPT Shortcode Generator plugin prior to or at version 1.0. Root cause details are not explicitly stated in the provided documents, but the vulnerability is described as a stored XSS affecting admin-level contexts. Public ex...

CVE-2023-45644 WordPress CPT Shortcode Generator Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin = 1.0 versions...

PT-2023-32299 · WordPress · Reusable Text Blocks

Name of the Vulnerable Software and Affected Versions: Reusable Text Blocks plugin for WordPress versions up to, and including, 1.5.3 Description: The issue is related to Stored Cross-Site Scripting via the 'text-blocks' shortcode due to insufficient input sanitization and output escaping on...

PT-2023-31779 · WordPress · Delete Me

Name of the Vulnerable Software and Affected Versions: Delete Me plugin for WordPress versions up to, and including, 3.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin delete me shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-32294 · WordPress · Live Chat With Facebook Messenger

Name of the Vulnerable Software and Affected Versions: Live Chat with Facebook Messenger plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode due to insufficient input sanitization and outpu...

PT-2023-31682 · WordPress · Advanced Menu Widget

Name of the Vulnerable Software and Affected Versions: Advanced Menu Widget plugin for WordPress versions up to, and including, 0.4.1 Description: The issue is related to Stored Cross-Site Scripting via the 'advMenu' shortcode due to insufficient input sanitization and output escaping on...

PT-2023-29621 · WordPress · Cpt Shortcode Generator

Name of the Vulnerable Software and Affected Versions: CPT Shortcode Generator plugin versions prior to 1.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 1.1...

WordPress LiteSpeed Cache 5.6 Cross Site Scripting

Vulnerability Summary from Wordfence Intelligence Description: LiteSpeed Cache = 5.6 – Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Affected Plugin: LiteSpeed Cache Plugin Slug: litespeed-cache Affected Versions: = 5.6 CVE ID: CVE-2023-4372 CVSS Score: 6.4 Medium CVSS...

PT-2023-28939 · WordPress · Litespeed Cache

Name of the Vulnerable Software and Affected Versions: LiteSpeed Cache plugin for WordPress versions up to, and including, 5.6 Description: The issue is related to Stored Cross-Site Scripting via the esi shortcode due to insufficient input sanitization and output escaping on user-supplied...

CVE-2023-5337

The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...