CVE-2023-33002

Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2023-33007: Improper Neutralization of Input During Web Page Generation

Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2023-24137

Name of the Vulnerable Software and Affected Versions Jenkins LoadComplete support Plugin versions 1.0 and earlier Description The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because the LoadComplete test name is not properly escaped, allowing attackers with...

PT-2023-24133

Name of the Vulnerable Software and Affected Versions Jenkins TestComplete support Plugin versions 2.8.1 and earlier Description The issue is related to a stored cross-site scripting XSS vulnerability. This occurs because the TestComplete project name is not properly escaped, allowing attackers...

CVE-2023-33002: Improper Neutralization of Input During Web Page Generation

Jenkins TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-45818

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Hero Banner Ultimate plugin = 1.3.4 versions...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46842 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID...

CVE-2023-24443

Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2023-24443

Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2022-4022

The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While version 2.5 adds the ability to sanitize image as they are uploaded, the plugin defaults to disable sanitization and does not restrict SV...

CVE-2022-4022

The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While version 2.5 adds the ability to sanitize image as they are uploaded, the plugin defaults to disable sanitization and does not restrict SV...

CVE-2022-4022

The CVE-2022-4022 entry concerns the WordPress SVG Support plugin (versions 2.5–2.5.1). The root cause is insecure default settings that do not sanitize SVG files containing JavaScript, permitting authenticated users with author-level privileges or higher to upload malicious SVGs that can be embe...

WordPress Awesome Support plugin <= 6.1.1 - Auth. Arbitrary Exported Tickets Download vulnerability

Auth. Arbitrary Exported Tickets Download vulnerability discovered by dc11 in WordPress Awesome Support plugin versions = 6.1.1. Solution Update the WordPress Awesome Support plugin to the latest available version at least 6.1.2...

CVE-2022-1755

The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks...

CVE-2022-1755 SVG Support < 2.5 - Author+ Stored Cross-Site Scripting

The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks...

GHSA-QRQM-574X-Q7F2 Awesome Support vulnerable to persistent cross-site scripting

Multiple Authenticated custom specific plugin role Persistent Cross-Site Scripting XSS vulnerability in Awesome Support plugin = 6.0.7 at WordPress...

CVE-2022-38073 WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)

Multiple Authenticated custom specific plugin role Persistent Cross-Site Scripting XSS vulnerability in Awesome Support plugin = 6.0.7 at WordPress...

CVE-2022-38073

CVE-2022-38073 affects the WordPress Awesome Support plugin (versions ≤ 6.0.7). The root cause is insufficient sanitization of the ticket title, enabling a stored XSS by users with a custom plugin role (authenticated). The impact is persistent cross-site scripting within the plugin context. Advis...

CVE-2022-2559

The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users...

WordPress plugin Fluent Support has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...