12337 matches found
CVE-2023-28790
CVE-2023-28790 affects the WordPress plugin Simple Staff List (versions
Simple URLs < 118 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WordPress plugin Simple URLs - Link Cloaking, Product Displays, and Affiliate Link Management Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
WordPress plugin Simple Staff List Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2023-5135
CVE-2023-5135 concerns the WordPress plugin “Simple Cloudflare Turnstile.” A stored XSS flaw exists in versions up to and including 1.23.1 due to insufficient input sanitization and output escaping on user-supplied attributes in the gravity-simple-turnstile shortcode. Exploitation requires an aut...
PT-2023-21966 · Brett Shumaker · Simple Staff List
Name of the Vulnerable Software and Affected Versions: Brett Shumaker Simple Staff List plugin versions 2.2.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with editor or higher...
WordPress Simple Posts Ticker Plugin < 1.1.6 is vulnerable to Cross Site Scripting (XSS)
Software Simple Posts Ticker Type Plugin Vulnerable versions 1.1.6 Fixed in 1.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4646 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 90737b96b35d Credits Dmitrii Ignatyev...
PT-2023-27587 · Unknown · Lasso Simple Urls
Name of the Vulnerable Software and Affected Versions: Lasso Simple URLs plugin versions = 117 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them to steal user da...
WordPress Simple Posts Ticker Plugin < 1.1.6 is vulnerable to Cross Site Scripting (XSS)
Software Simple Posts Ticker Type Plugin Vulnerable versions 1.1.6 Fixed in 1.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4725 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fb8f01332256 Credits Dmitrii Ignatyev...
WordPress Simple Cloudflare Turnstile Plugin <= 1.23.1 is vulnerable to Cross Site Scripting (XSS)
Software Simple Cloudflare Turnstile Type Plugin Vulnerable versions = 1.23.1 Fixed in 1.23.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5135 Patch priority Low CVSS severity Low 6.5 Developer RelyWP PSID 89023cff61f7 Credits Lana Codes Required...
PT-2023-31787 · Cloudflare · Simple Cloudflare Turnstile
Name of the Vulnerable Software and Affected Versions: The Simple Cloudflare Turnstile plugin for WordPress versions up to, and including, 1.23.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes...
WordPress Simple Membership Plugin <= 4.3.4 is vulnerable to Privilege Escalation
Software Simple Membership Type Plugin Vulnerable versions = 4.3.4 Fixed in 4.3.5 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-41957 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 1bb17eda4daa Credits Rafie...
Simple Posts Ticker < 1.1.6 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Add a post with the shortcode:...
WordPress Simple Membership Plugin <= 4.3.4 is vulnerable to Privilege Escalation
Software Simple Membership Type Plugin Vulnerable versions = 4.3.4 Fixed in 4.3.5 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-41956 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 9136913b17b8 Credits Rafie...
PT-2023-36038 · Icu · Icu
Name of the Vulnerable Software and Affected Versions: icu 74 affected versions not specified Description: The issue is related to a crash in the icu 74 library, specifically in the UnicodeString class. The crash occurs when the copyFrom function is called, leading to a segmentation fault on an...
CVE-2023-39675
SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php...
Simple Download Counter < 1.6.1 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...
Malicious code in simple-team-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5da4b4631227adabb1a524dc451f3f7fce259d5c7c64d148e91f6edc74d4a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8180 Malicious code in simple-team-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5da4b4631227adabb1a524dc451f3f7fce259d5c7c64d148e91f6edc74d4a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
