9590 matches found
PT-2023-18652 · WordPress · Tiempo.Com Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: Tiempo.com WordPress plugin versions 0.1.2 and earlier Description: The issue is related to the lack of a CSRF check when deleting a shortcode in the Tiempo.com WordPress plugin. This could allow attackers to make logged-in admins delete...
PT-2023-16380 · WordPress · Yarpp
Name of the Vulnerable Software and Affected Versions: YARPP WordPress plugin versions prior to 5.30.3 Description: The issue is related to the YARPP WordPress plugin, which does not validate and escape some of its shortcode attributes before using them in SQL statements. This could allow any...
CVE-2023-4276
The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...
PT-2023-28608 · WordPress · Embedpress
Name of the Vulnerable Software and Affected Versions: EmbedPress plugin for WordPress versions up to, and including, 3.8.2 Description: The issue is related to Stored Cross-Site Scripting via the 'embedpress calendar' shortcode due to insufficient input sanitization and output escaping on...
WordPress Plugin Absolute Privacy Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post Access
Description The plugin does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected ones PoC Run the below command in the developer...
Rank Math SEO < 1.0.119.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Simple Blog Card < 1.31 - Contributor+ Stored XSS via Shortcode
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the...
Simple Blog Card < 1.31 - Contributor+ Stored XSS via Shortcode
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks As a contributor, put the...
Metasploit Weekly Wrap up
Unauthenticated RCE in VMware Product This week, community contributor h00die added an exploit module that leverages a command injection vulnerability in VMWare Aria Operations for Networks, formerly known as vRealize Network Insight. Versions 6.2 to 6.10 are vulnerable CVE-2023-20887. A remote...
WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)
Software Google Map Shortcode Type Plugin Vulnerable versions = 3.1.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-38396 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ad78bcfdec4a Credits thiennv Required...
CVE-2023-37892
Cross-Site Request Forgery CSRF vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin = 6.0.8 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin = 6.0.8 versions...
CVE-2023-37892 WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB plugin = 6.0.8 versions...
CVE-2023-37892
CVE-2023-37892 describes a CSRF vulnerability in the WordPress plugin PluginPress Shortcode IMDB affecting versions <= 6.0.8 . The vulnerability is unpatched per Wordfence details; exploitation would involve convincing an authenticated user to perform an unwanted action on behalf of an attacke...
WordPress Simple Social Page Widget & Shortcode Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)
Software Simple Social Page Widget & Shortcode Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0903d51f92c2 Credits Rafie Muhamm...
WordPress Five-Star Ratings Shortcode Plugin < 1.2.48 is vulnerable to Cross Site Scripting (XSS)
Software Five-Star Ratings Shortcode Type Plugin Vulnerable versions 1.2.48 Fixed in 1.2.48 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ed6e5abc9527 Credits Rafie Muhammad...
PT-2023-26163 · Pluginpress · Pluginpress Shortcode Imdb
Name of the Vulnerable Software and Affected Versions: PluginPress Shortcode IMDB plugin versions 6.0.8 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...
WordPress Plugin Shortcode IMDB 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...