CVE-2022-4545 Sitemap < 4.4 - Contributor+ Stored XSS

The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users...

PT-2023-14672 · WordPress · Sitemap Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Sitemap WordPress plugin versions prior to 4.4 Description: The issue concerns the Sitemap WordPress plugin, where it fails to validate and escape certain shortcode attributes before outputting them, potentially allowing Stored Cross-Site...

WordPress plugin Sitemap 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Simple Sitemap < 3.5.8 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...

WordPress Simple Sitemap – Create a Responsive HTML Sitemap Plugin < 3.5.8 is vulnerable to Cross Site Scripting (XSS)

Software Simple Sitemap – Create a Responsive HTML Sitemap Type Plugin Vulnerable versions 3.5.8 Fixed in 3.5.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4472 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID...

Simple Sitemap < 3.5.8 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC Exploit...

Sitemap < 4.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. pagelist...

Sitemap < 4.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC pagelist...

CVE-2022-3835

The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3835

The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3835 Kwayy HTML Sitemap < 4.0 - Admin+ Stored XSS

The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3835 Kwayy HTML Sitemap < 4.0 - Admin+ Stored XSS

The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3835

The CVE-2022-3835 issue affects the WordPress plugin Kwayy HTML Sitemap (versions prior to 4.0). The vulnerability arises because the plugin does not sanitize/escape certain settings, enabling a Stored Cross‑Site Scripting (XSS) defect that can be triggered by high‑privilege users such as admins,...

PT-2022-24381 · WordPress · Kwayy Html Sitemap

Name of the Vulnerable Software and Affected Versions: Kwayy HTML Sitemap WordPress plugin versions prior to 4.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example,...

WordPress Plugin Kwayy HTML Sitemap 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Kwayy HTML Sitemap < 4.0 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Click the 'Settings' button of this plugin. 2...

Kwayy HTML Sitemap < 4.0 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Click the 'Settings' button of this plugin...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in David Cole Simple SEO plugin = 1.8.12 on WordPress allows attackers to create or delete sitemaps...

PT-2022-23353 · Unknown · David Cole Simple Seo

Name of the Vulnerable Software and Affected Versions: David Cole Simple SEO plugin versions prior to 1.8.13 Description: The issue concerns a Missing Authorization and Cross-Site Request Forgery CSRF vulnerability, as well as a Broken Access Control vulnerability. This allows attackers to...