314 matches found
WordPress 访问控制错误漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. An Access Control Error vulnerability exists in WordPress Plugins, which stems from The Logo Slider and...
CVE-2021-24544
The CVE-2021-24544 entry refers to the Responsive WordPress Slider plugin (versions up to 2.2.0). The vulnerability is a stored cross-site scripting (XSS) flaw where several Slider options are not properly sanitised/escaped, enabling attackers with a low-privilege role (as low as subscriber) to i...
CVE-2021-24544 Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site Scripting
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders...
Responsive WordPress Slider plugin <= 2.2.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Abhiyan Chheri and Veshraj Ghimire in Responsive WordPress Slider plugin versions = 2.2.0. Solution Deactivate and delete. This plugin has been closed as of September 20, 2021 and is not available for download. This closure is temporary,...
CVE-2021-24463
The getsliders function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the getresults DB calls, leading to SQL injection issues in the admin dashboard...
CVE-2021-24132
The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user Admin, or medium one such as Contributor+ if "Role Options" is turn on for other users to perform a SQL...
CVE-2021-24132
CVE-2021-24132 affects the WordPress plugin Slider by 10Web up to version 1.2.35; version 1.2.36 fixes it. The root cause is a SQL Injection in the plugin’s admin endpoints (bulk_action, export_full, save_slider_db) exploitable by an authenticated user (Admin or certain Contributor+ roles when en...
CVE-2015-9454
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...
CVE-2015-9454
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...
WordPress Royal-Slider plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Royal-Slider is a responsive image gallery and content slider plugin used in it. A cross-site scripting vulnerability exists in the...
CVE-2015-9417
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS...
CVE-2019-15866
The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wpajaxcrellysliderimportSlider...
CVE-2018-20368
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback...
CVE-2018-20368
CVE-2018-20368 affects the WordPress Master Slider plugin (versions around 3.2.7 and 3.5.1) and causes an XSS via the wp-admin/admin-ajax.php Name input field in the MSPanel.Settings value during Callback. The connected sources consistently describe it as a cross‑site scripting vulnerability in M...
Master Slider <= 3.7.0 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin does not properly sanitise the slider name when creating or editing a slider, leading to an Authenticated editor+ Stored Cross-Site Scripting issue which will be triggered in the Slider table /wp-admin/admin.php?page=master-slider. Edit WPScanTeam: - The original report was from 2018,...
WordPress Testimonial Slider Plugin SQL Injection Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers set up a personal blog site.Testimonial Slider plugin is one of the post to add plugin. A SQL injection vulnerability exists in the '$wpdb-query...
CVE-2018-5373
The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php trid parameter...
CVE-2018-5373
The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php trid parameter...
