PT-2022-13957

Name of the Vulnerable Software and Affected Versions ULeak Security & Monitoring WordPress plugin versions prior to 1.2.4 Description The issue concerns a lack of authorization and CSRF checks when updating settings, as well as insufficient sanitization and escaping in certain settings. This cou...

CVE-2022-1557: Improper Neutralization of Input During Web Page Generation

The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site...

WordPress ULeak Security & Monitoring plugin <= 1.2.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability was discovered by Hassan Khan Yusufzai Splint3r7 in WordPress ULeak Security & Monitoring plugin versions = 1.2.3. Solution No patched version is available...

ULeak Security & Monitoring <= 1.2.3 - Subscriber+ Stored Cross-Site Scripting

The plugin does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings...