9192 matches found
Design/Logic Flaw
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak...
WordPress 5.0.x < 5.0.6 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in post previews by contributors. - A cross-site scripting XSS vulnerability in stored comments. - An unspecified issue with...
WordPress 3.8.x < 3.8.30 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in post previews by contributors. - A cross-site scripting XSS vulnerability in stored comments. - An unspecified issue with...
WordPress 4.9.x < 4.9.11 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in post previews by contributors. - A cross-site scripting XSS vulnerability in stored comments. - An unspecified issue with...
WordPress 4.1.x < 4.1.27 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in post previews by contributors. - A cross-site scripting XSS vulnerability in stored comments. - An unspecified issue with...
WordPress 5.2.x < 5.2.3 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability in post previews by contributors. - A cross-site scripting XSS vulnerability in stored comments. - An unspecified issue with...
WordPress XSS Bug Allows Drive-By Code Execution
A just-patched stored cross-site scripting XSS vulnerability in WordPress allowed drive-by remote code-execution, according to an analysis. The bug exists in the built-in editor Gutenberg, which is found in WordPress 5.0 and above. Zhouyuan Yang, a threat-researcher at FortiGuard Labs, said that...
Cross-site Scripting (XSS)
wordpress is vulnerable to cross-site scripting XSS. The attack is due to not handling of the existing rel attribute in wprelnofollowcalback, allowing an attacker to inject arbitrary script during shortcode previews...
CVE-2019-16219
WordPress before 5.2.3 allows XSS in shortcode previews...
DEBIAN-CVE-2019-16219
WordPress before 5.2.3 allows XSS in shortcode previews...
CVE-2019-16219
WordPress before 5.2.3 allows XSS in shortcode previews...
CVE-2019-16219
WordPress before 5.2.3 allows XSS in shortcode previews...
Design/Logic Flaw
WordPress before 5.2.3 allows XSS in shortcode previews...
UBUNTU-CVE-2019-16219
WordPress before 5.2.3 allows XSS in shortcode previews...
CVE-2019-16219
CVE-2019-16219 concerns WordPress core prior to version 5.2.3, where a stored XSS flaw in shortcode previews could allow injection of malicious scripts. The vulnerability arises from improper handling of shortcode previews, enabling an attacker to potentially execute script when a user previews a...
CVE-2019-16219
WordPress before 5.2.3 allows XSS in shortcode previews...
PT-2019-5209 · WordPress · Wordpress
Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.3 Description: The issue is related to an error in the shortcode preview functionality of the WordPress content management system, allowing for XSS attacks. This could potentially enable a remote attacker to...
FreeBSD : wordpress -- multiple issues (8a9f86de-d080-11e9-9051-4c72b94353b5)
wordpress developersreports : Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues. The first, a cross-site scripting XSS vulnerability found in post previews by contributors. The second was a cross-site scripting vulnerability in stored comments. Props to Tim Coen f...
WordPress 5.0-5.2.2 - Authenticated Stored XSS in Shortcode Previews
Description According to the WordPress release notes: "Props to Zhouyuan Yang of Fortinet’s FortiGuard Labs who disclosed a vulnerability for cross-site scripting XSS in shortcode previews."...