EUVD-2021-11970

Malware in sbrugna...

CVE-2024-3167

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitterusername’ parameter in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

PT-2024-24183 · WordPress · Ocean Extra

Name of the Vulnerable Software and Affected Versions: The Ocean Extra plugin for WordPress versions up to, and including, 2.2.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

Hubbub Lite < 1.32.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup As admin, enable the 'Floating Sidebar...

CVE-2021-25058 The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS)

The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting XSS within the Twitter username to mention text field...

PT-2022-9614

Name of the Vulnerable Software and Affected Versions Buffer Button WordPress plugin version 1.0 Description The issue allows for Authenticated Stored Cross Site Scripting XSS within the Twitter username to mention text field. Recommendations For Buffer Button WordPress plugin version 1.0, update...

CVE-2021-25058: Improper Neutralization of Input During Web Page Generation

The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting XSS within the Twitter username to mention text field...

WordPress plugin Buffer Button 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Buffer Button prior to version 1.0, which...

PT-2014-8984

Name of the Vulnerable Software and Affected Versions Post to Twitter plugin versions 0.7 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the idptt twitter...

PT-2014-8989

Name of the Vulnerable Software and Affected Versions Twitter LiveBlog plugin versions 1.1.2 and earlier for WordPress Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS...

CVE-2014-4303: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the 1 Twitter and 2 Facebook username settings...

PT-2014-5798

Name of the Vulnerable Software and Affected Versions Drupal Touch theme versions 7.x-1.x before 7.x-1.9 Description The issue allows remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the Twitter and Facebook username...

PT-2014-2437

Name of the Vulnerable Software and Affected Versions Elgg versions prior to 1.7.17 Elgg versions 1.8.x prior to 1.8.13 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the paramstwitter username parameter to t...