WordPress Backup Migration Plugin PHP Filter Chain RCE

This module exploits an unauth RCE in the WordPress plugin: Backup Migration use exploit/multi/http/wp/backupmigrationphpfilter msf undefinedbackupmigrationphpfilter show actions ...actions... msf undefinedbackupmigrationphpfilter set ACTION msf undefinedbackupmigrationphpfilter show options...

GHSA-FPVW-6M5V-HQFP Capsule Proxy Authentication bypass using an empty token

The privilege escalation is based on a missing check if the user is authenticated based on the TokenReview result. All the clusters running with the anonymous-auth Kubernetes API Server setting disable set to false are affected since it would be possible to bypass the token review mechanism,...

CVE-2023-47514

CVE-2023-47514 concerns the Star CloudPRNT for WooCommerce WordPress plugin. The vulnerability is an unauthenticated reflected Cross‑Site Scripting (XSS) in versions

CVE-2023-47520

CVE-2023-47520 : Unauth. Reflected Cross-Site Scripting (XSS) in the WordPress plugin Responsive Column Widgets (vendor: Michael Uno / miunosoft), affecting versions

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Scribit Shortcodes Finder plugin = 1.5.3 versions...

CVE-2023-47696

The CVE-2023-47696 entry concerns the Gravity Master Product Enquiry for WooCommerce plugin for WordPress. Affected component: the plugin’s input handling/escaping allows unauthenticated Stored XSS. Vulnerable versions are ≤ 3.0; the issue is mitigated in version 3.1. The attack vector is network...

CVE-2023-46643

CVE-2023-46643 corresponds to a Cross-Site Scripting (XSS) vulnerability in the WordPress CloudNet360 plugin (cloudnet-sync) affecting versions 3.2.0 or apply vendor-recommended mitigation if available. If upgrading is not feasible, monitor for vendor advisories and implement general WAF/input s...

CVE-2023-47185

CVE-2023-47185: Unauth. stored XSS in the WordPress wpDiscuz plugin (gVectors Team Comments) affects versions

CVE-2023-46312 WordPress Smart Online Order for Clover Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Zaytech Smart Online Order for Clover plugin = 1.5.4 versions...

CVE-2023-46209

CVE-2023-46209 affects the WordPress Grid Plus (G5Theme Grid Plus – Unlimited grid) plugin. Affected versions are &lt;= 1.3.2 (per CVE entry) and Patchstack cites vulnerable up to

CVE-2023-46208

CVE-2023-46208 is an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin, affecting versions

CVE-2023-46090

CVE-2023-46090 affects WebDorado WDSocialWidgets WordPress plugin (versions

CVE-2023-46076

CVE-2023-46076 is an unauthenticated reflected XSS in the WooCommerce PDF Invoice Builder plugin for WordPress, affecting versions up to 1.2.102. The vulnerability stems from improper input handling in the plugin, enabling injection of scripts via user-controlled input. Unpatched in 1.2.102, expl...

CVE-2023-46072

CVE-2023-46072 is an unauthenticated reflected XSS in the WordPress plugin Add Shortcodes Actions And Filters (versions

CVE-2023-46071

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ClickDatos Protección de Datos RGPD plugin = 3.1.0 versions...

CVE-2023-45759 WordPress Peter’s Custom Anti-Spam Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Peter Keung Peter’s Custom Anti-Spam plugin = 3.2.2 versions...

CVE-2023-45065 WordPress Bulk NoIndex & NoFollow Toolkit Plugin <= 1.42 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin = 1.42 versions...

CVE-2023-23737

CVE-2023-23737 affects the WordPress plugin MainWP Broken Links Checker Extension (≤ 4.0). It is described as an unauthenticated SQL Injection vulnerability with high impact (confidentiality, integrity, and availability) and network access, no privileges required, and no user interaction. Across ...

CVE-2023-44474

CVE-2023-44474 concerns the Tiger Forms – Drag and Drop Form Builder WordPress plugin. The vulnerability is an unauthenticated, reflected Cross-Site Scripting (XSS) flaw affecting versions ≤ 2.0.0. Root cause details are not explicitly provided beyond the XSS classification, but public sources co...

PT-2023-28029 · WordPress · I Thirteen Web Solution Photo Gallery Slideshow & Masonry Tiled Gallery

Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution Photo Gallery Slideshow & Masonry Tiled Gallery plugin versions = 1.0.13 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts...