WordPress plugin WPB Advanced FAQ 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Custom Content Shortcode 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A path traversal vulnerability exists in WordPress...

PT-2023-16053 · WordPress · Getresponse

Name of the Vulnerable Software and Affected Versions: GetResponse for WordPress plugin versions 5.5.31 and earlier Description: The issue arises from the plugin's failure to validate and escape certain shortcode attributes before outputting them in a page or post where the shortcode is embedded...

PT-2023-16613 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: WordPress Shortcodes Plugin — Shortcodes Ultimate versions prior to 5.12.8 Description: The issue allows any authenticated users, such as subscribers, to retrieve arbitrary user meta, excluding the user pass, via the user shortcode. This...

WordPress plugin Custom Content Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-16061 · WordPress · Responsive Clients Logo Gallery Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Clients Logo Gallery Plugin for WordPress versions 1.1.9 and earlier Description: The issue arises from the plugin's failure to validate and escape some of its shortcode attributes before outputting them in a page or post,...

PT-2023-16220 · WordPress · Wpb Advanced Faq

Name of the Vulnerable Software and Affected Versions: WPB Advanced FAQ WordPress plugin versions 1.0.0 through 1.0.6 Description: The WPB Advanced FAQ WordPress plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is...

PT-2023-16131 · WordPress · Custom Content Shortcode

Name of the Vulnerable Software and Affected Versions: Custom Content Shortcode WordPress plugin versions 4.0.2 and earlier Description: The issue concerns the Custom Content Shortcode WordPress plugin, which does not properly validate and escape some of its shortcode attributes before outputting...

WordPress plugin Smart Logo Showcase Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-16193 · WordPress · Custom Content Shortcode

Name of the Vulnerable Software and Affected Versions: Custom Content Shortcode WordPress plugin versions 4.0.2 and earlier Description: The Custom Content Shortcode WordPress plugin does not validate one of its shortcode attributes, which could allow users with a contributor role and above to...

WordPress plugin Saan World Clock 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

WordPress plugin React Webcam 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress Profile Builder 3.9.0 Missing Authorization

Description: Profile Builder – User Profile & User Registration Forms get’. Finally, the function returns the value of the retrieved ‘key’ for the given ‘userid’. During this process, capability checks are not properly implemented to ensure that the user executing the function is authorized to...

WordPress Profile Builder 3.9.0 Missing Authorization Vulnerability

WordPress Profile Builder plugin versions 3.9.0 and below suffer from a missing authorization vulnerability in wppbtoolboxusermetahandler. Description: Profile Builder – User Profile & User Registration Forms get’. Finally, the function returns the value of the retrieved ‘key’ for the given...

Vulnerability Patched in Cozmolabs Profile Builder Plugin – Information Disclosure Leads to Account Takeover

Hundreds, if not thousands of WordPress plugins are conceived with the idea of making site building and maintenance easier for site owners. They add features not available in WordPress Core that would otherwise require site owners to write their own code to extend functionality. However, these...

CVE-2022-4661

The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored...

CVE-2023-0172

The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0073

The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0172

The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0066

The Companion Sitemap Generator WordPress plugin through 4.5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scriptin...