PT-2023-32245

Name of the Vulnerable Software and Affected Versions SendPress Newsletters plugin for WordPress versions up to, and including, 1.22.3.31 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcodes, allowing...

PT-2023-30839 · WordPress · Social Warfare

Name of the Vulnerable Software and Affected Versions: The Social Sharing Plugin - Social Warfare plugin for WordPress versions up to, and including, 4.4.3 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'social warfare'...

PT-2023-32189 · Bitly · Bitly'S Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Bitly's plugin for WordPress versions up to, and including, 2.7.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode due to insufficient input sanitization and output escaping on user-supplie...

CVE-2023-5661: Improper Neutralization of Input During Web Page Generation

The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including, 1.5.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2023-5703: Improper Neutralization of Input During Web Page Generation

The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2023-5577: Improper Neutralization of Input During Web Page Generation

The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-5567: Improper Neutralization of Input During Web Page Generation

The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-5709: Improper Neutralization of Special Elements used in an SQL Command

The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-5507: Improper Neutralization of Input During Web Page Generation

The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-5658: Improper Neutralization of Input During Web Page Generation

The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmapit' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2023-5076: Improper Neutralization of Input During Web Page Generation

The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2023-32182 · WordPress · Qr Code Tag

Name of the Vulnerable Software and Affected Versions: QR Code Tag plugin for WordPress versions up to, and including, 1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'qrcodetag' shortcode, allowing authenticated...

PT-2023-32141 · WordPress · Imagemapper

Name of the Vulnerable Software and Affected Versions: ImageMapper plugin for WordPress versions up to, and including, 1.2.6 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'imagemap' shortcode, allowing authenticated...

PT-2023-32243 · WordPress · Wp Mapit

Name of the Vulnerable Software and Affected Versions: WP MapIt plugin for WordPress versions up to, and including, 2.7.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'wp mapit' shortcode. This allows authenticated...

PT-2023-31632

Name of the Vulnerable Software and Affected Versions Ziteboard Online Whiteboard plugin for WordPress versions up to, and including, 2.9.9 Description The issue arises from insufficient input sanitization and output escaping in the ziteboard shortcode, allowing authenticated attackers with...

CVE-2023-5659: Improper Neutralization of Input During Web Page Generation

The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2023-5669: Improper Neutralization of Input During Web Page Generation

The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, and including, 0.8.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-5743: Improper Neutralization of Input During Web Page Generation

The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2022-47432

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB allows SQL Injection.This issue affects Shortcode IMDB: from n/a through 6.0.8...

CVE-2022-47432

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB allows SQL Injection.This issue affects Shortcode IMDB: from n/a through 6.0.8...