CVE-2022-0760

The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the postid parameter before using it in a SQL statement via the qcopdupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection...

CVE-2022-0760

The CVE-2022-0760 entry describes a SQL injection in the WordPress plugin WordPress Simple Link Directory (versions before 7.7.2). The vulnerability arises because the plugin does not validate or escape the post_id parameter before using it in a SQL statement in the qcopd_upvote_action AJAX call,...

CVE-2022-0681

Consolidated details for CVE-2022-0681: The WordPress plugin Simple Membership (pre-4.1.0) does not perform CSRF checks when deleting Transactions, allowing a logged-in admin to delete arbitrary transactions via CSRF. Impact is a CSRF vulnerability enabling unauthorized deletion of transactions b...

CVE-2022-0681 Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF

The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack...

PT-2022-17765 · Unknown · Simple Subscription Website

Name of the Vulnerable Software and Affected Versions: Simple Subscription Website version 1.0 Description: The issue allows attackers to dump the application's database via crafted HTTP requests. This is made possible by a SQL injection vulnerability via the id parameter in the "view plan"...

WordPress plugin Simple Link Directory SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. The WordPress plugin Simple Link Directory before...

WordPress plugin Simple Membership 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin Simpl...

Simple Mobile Comparison Website 1.0 Cross Site Scripting

Exploit Title: Simple Mobile Comparison Website v1.0 - Reflected Cross-Site Scripting XSS Unauthenticated Author: Ayedh AlQahtani Discovery Date: 2022-03-18 Vendor Homepage: https://www.sourcecodester.com/ Tested Version: v1.0 Tested on: XAMPP, Windows 11 Pro x64 es Vulnerability Type: Reflected...

WordPress Simple Tracking plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in versions of WordPress Simple Tracking plugin prior to 1.7, which stems from the plugin's...

CVE-2022-22735

The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation and CSRF checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks...

CVE-2022-22734

The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them...

CVE-2022-22734

The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them...

CVE-2022-0700

The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-22734

The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them...

CVE-2022-0700

The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24692

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2022-22735

The CVE-2022-22735 entry describes a SQL injection vulnerability in WordPress Simple Quotation plugin (versions

CVE-2022-22734

The CVE-2022-22734 entry concerns the WordPress Simple Quotation plugin (versions

CVE-2022-0700

CVE-2022-0700 affects the WordPress Simple Tracking plugin prior to version 1.7. The vulnerability is a stored Cross-Site Scripting (XSS) caused by the plugin not sanitising and escaping settings, which could let high-privilege users (e.g., admins) execute scripts even when unfiltered_html is dis...

CVE-2021-24692 Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal

The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...