teachPress < 9.0.6 - Cross-Site Request Forgery via delete_database()

Description The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.5. This is due to missing or incorrect nonce validation on the deletedatabase function. This makes it possible for unauthenticated attackers to clear the database...

WordPress teachPress Plugin <= 9.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software teachPress Type Plugin Vulnerable versions = 9.0.5 Fixed in 9.0.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49163 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 932dc955a019 Credits LVT-tholv2k Required...

WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software teachPress Type Plugin Vulnerable versions = 9.0.4 Fixed in 9.0.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48755 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ef454afbab45 Credits LVT-tholv2k Required...

CVE-2023-36501

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 9.0.2 versions...

CVE-2023-36501

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 9.0.2 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 9.0.2 versions...

CVE-2023-36501 WordPress teachPress Plugin <= 9.0.2 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 9.0.2 versions...

CVE-2023-36501

The CVE-2023-36501 entry concerns the WordPress teachPress plugin (affected versions ≤ 9.0.2) and describes an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability via meta_field_id and cite_id. The issue is confirmed in multiple sources (Patchstack and CVE/NVD references) with a r...

CVE-2023-36501 WordPress teachPress Plugin <= 9.0.2 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 9.0.2 versions...

WordPress plugin teachPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2023-25596 · WordPress · Teachpress

Name of the Vulnerable Software and Affected Versions: teachPress plugin versions = 9.0.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading...

WordPress teachPress Plugin <= 9.0.2 is vulnerable to Cross Site Scripting (XSS)

Software teachPress Type Plugin Vulnerable versions = 9.0.2 Fixed in 9.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36501 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID cec894d7c58b Credits Le Ngoc Anh Required...

CVE-2023-22704

Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 8.1.8 versions...

CVE-2023-22704

Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 8.1.8 versions...

CVE-2023-22704

The CVE-2023-22704 entry concerns the teachPress WordPress plugin, affected versions ≤ 8.1.8. The underlying issue is a Reflected Cross-Site Scripting (XSS) vulnerability, caused by the plugin not sanitizing/escaping inputs (notably the tab parameter) before output. Exploitation is described as p...

CVE-2023-22704 WordPress teachPress Plugin <= 8.1.8 is vulnerable to Cross Site Scripting (XSS)

Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 8.1.8 versions...

WordPress Plugin Winkler teachPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2023-18647 · WordPress · Teachpress

Name of the Vulnerable Software and Affected Versions: teachPress plugin versions = 8.1.8 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take control ...

WordPress teachPress Plugin <= 8.1.8 is vulnerable to Cross Site Scripting (XSS)

Software teachPress Type Plugin Vulnerable versions = 8.1.8 Fixed in 8.1.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22704 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8de649d41654 Credits Nguyen Xuan Chien...

teachPress < 8.1.9 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...