CVE-2021-37463

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name stored...

CVE-2024-6792

The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page...

CVE-2024-6792

Vulnerability context: CVE-2024-6792 affects the WP ULike WordPress plugin prior to 4.7.2.1. The issue stems from improper sanitization of user display names when rendering on public pages, which is described in Red Hat and Patchstack entries as a subscriber-level stored XSS exposure. Affected so...

CVE-2024-1766

The CVE-2024-1766 is a Stored Cross-Site Scripting vulnerability in the WordPress Download Manager plugin (versions

CVE-2024-4439

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2024-4439

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2024-4439

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2024-4439

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2024-4439

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2024-1759

CVE-2024-1759: WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user’s display name in all versions up to 4.6.9 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (subscriber level or higher) and can allow injecti...

CVE-2024-2500 ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name

The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and...

WordPress Plugin Site Reviews Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-19618 · WordPress · Site Reviews

Name of the Vulnerable Software and Affected Versions: Site Reviews plugin for WordPress versions up to, and including, 6.11.4 Description: The issue is related to Stored Cross-Site Scripting via the user display name due to insufficient input sanitization and output escaping. This allows...

Site Reviews < 6.11.7 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name

Description The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber...

GHSA-JR83-8X65-XCR5 Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups...

CVE-2023-5551

Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups...

CVE-2023-5551 Moodle: forum summary report shows students from other groups when in separate groups mode

Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups...

Cross-Site Scripting (XSS)

alextselegidis/easyappointments is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user display name sanitization in backendheader.php, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Fedora 36 : nextcloud (2022-902df3b060)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-902df3b060 advisory. Security fix for CVE-2022-39346 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Design/Logic Flaw

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to...