2334 matches found
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...
CVE-2023-22684 WordPress Subscribers – Free Web Push Notifications Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...
CVE-2023-22684 WordPress Subscribers – Free Web Push Notifications Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Subscribers.Com Subscribers plugin = 1.5.3 versions...
CVE-2023-22684
CVE-2023-22684 is an authenticated stored Cross-Site Scripting (XSS) vulnerability in the Subscribers.Com Subscribers WordPress plugin, affecting versions up to 1.5.3. The issue requires admin+ privileges and can result in payloads stored by the plugin and reflected to users. Public risk context ...
WordPress plugin Subscribers – Free Web Push Notifications 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
PT-2023-18629 · Subscribers.Com · Subscribers Plugin
Name of the Vulnerable Software and Affected Versions: Subscribers.Com Subscribers plugin versions 1.5.3 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions 1.5.3 and...
CVE-2022-41640
Auth. subscriber+ Stored Cross-Site Scripting XSS vulnerability in Rymera Web Co Wholesale Suite plugin = 2.1.5 versions...
PT-2023-14763 · Martin Lees · Exxp Plugin
Name of the Vulnerable Software and Affected Versions: Martin Lees Exxp plugin versions = 2.6.8 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated subscribers. There is no information provided about the estimated number of potentially...
CVE-2023-0424
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks...
CVE-2023-0388
The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...
Sql injection
The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...
CVE-2023-1414 WP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours...
CVE-2023-0424 MS-Reviews <= 1.5 - Subscriber+ Stored XSS
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks...
WordPress Subscribers – Free Web Push Notifications Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)
Software Subscribers – Free Web Push Notifications Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22684 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 892cf19e4971 Credi...
WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection
Software Email posts to subscribers Type Plugin Vulnerable versions = 6.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-46818 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID ac023e13840e Credits Le Ngoc Anh Required privilege...
KB5020863 - Description of the security update for SQL Server 2008 SP4 GDR: February 14, 2023
None None...
CVE-2022-4937
The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...
CVE-2022-4935
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...
Design/Logic Flaw
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...