EUVD-2021-11357

Malware in sbrugna...

CVE-2021-24445

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

WordPress My Site Audit plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Akash Rajendra Patil in WordPress My Site Audit plugin versions = 1.2.4. Solution Update the WordPress My Site Audit plugin to the latest available version at least 1.2.5...

CVE-2021-24445

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

Cross site scripting

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-24445

CVE-2021-24445 affects the WordPress My Site Audit plugin up to version 1.2.4. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) caused by failure to sanitize/escape the Audit Name field when creating audits, allowing a high-privilege user to inject JavaScript payloads even ...

My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue PoC Create an audit with the...

Semrush: SSRF and LFI in site-audit tool

SSRF and LFI vulnerability in Site Audit due to lack of connection protocol verification...

Semrush: XXE in Site Audit function exposing file and directory contents

Summary: The Project Site Audit function is vulnerable to XXE when parsing sitemap.xml files. Description: The Site Audit function spiders a given website and performs analysis on the discovered pages. In order to improve website spidering the URL of a sitemap.xml file can be provided. If provide...