WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers.Tickera plugin in versions prior to 3.4.8.3 suffers from a cross-site scripting vulnerability, which stems from a...

WordPress Tickera plugin <= 3.4.8.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ajit Bhatta in WordPress Tickera plugin versions = 3.4.8.2. Solution Update the WordPress Tickera plugin to the latest available version at least 3.4.8.3...

Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting

The plugin does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. PoC As unauthenticated, book an Event, and put the following...

Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting

The plugin does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. As unauthenticated, book an Event, and put the following payload ...

WordPress Tickera plugin <= 3.4.6.7 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Florian Hauser in WordPress Tickera plugin versions = 3.4.6.7. Solution Update the WordPress Tickera plugin to the latest available version at least 3.4.6.9...

Tickera WordPress Event Ticketing < 3.4.6.9 - Unauthenticated Sensitive Data Exposure

Due to missing authorization controls in the "admininit" hooks, all personal data from registered users of an event could be exported into a downloadable PDF file by every unauthenticated user. The event ID could be read from the page source and/or easily enumerated in sequence. According to the...

Tickera WordPress Event Ticketing < 3.4.6.9 - Unauthenticated Sensitive Data Exposure

Due to missing authorization controls in the "admininit" hooks, all personal data from registered users of an event could be exported into a downloadable PDF file by every unauthenticated user. The event ID could be read from the page source and/or easily enumerated in sequence. According to the...