Cross site scripting

Authenticated admin user role Stored Cross-Site Scripting XSS in WP-Appbox WordPress plugin = 4.3.20...

CVE-2021-36893 WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability

Authenticated author or higher user role Stored Cross-Site Scripting XSS vulnerability in Responsive Tabs WordPress plugin = 4.0.5...

CVE-2021-36896 WordPress Pricing Table plugin <= 1.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated author or higher user role Stored Cross-Site Scripting XSS vulnerability in Pricing Table WordPress plugin versions = 1.5.2...

CVE-2021-36910 WordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin user role Stored Cross-Site Scripting XSS in WP-Appbox WordPress plugin = 4.3.20...

CVE-2021-36826 WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability

Authenticated subscriber or higher user role if allowed to access projects Stored Cross-Site Scripting XSS vulnerability in weDevs WP Project Manager plugin = 2.4.13 versions...

CVE-2021-36851 WordPress Testimonial Slider plugin <= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerability

Authenticated editor or higher user role Cross-Site Scripting XSS vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin WordPress plugin via parameters mpsppostsbgcolor, mpsppostsdescriptioncolor, mpspslidenavbuttoncolor...

CVE-2022-25609

Stored Cross-Site Scripting XSS in Yoo Slider – Image Slider & Video Slider WordPress plugin allows attackers with contributor or higher user role to inject the malicious code...

CVE-2022-25609 WordPress Yoo Slider plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS in Yoo Slider – Image Slider & Video Slider WordPress plugin allows attackers with contributor or higher user role to inject the malicious code...

CVE-2022-0687 Amelia < 1.0.46 - Manager+ RCE

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role...

CVE-2021-23209 WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated admin user role Persistent Cross-Site Scripting XSS vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress plugin versions = 1.0.77.32...

Improper Authorization

librenms is vulnerable to improper authorization. The vulnerability exists due to the lack of validation of the user's role and level allowing an attacker to switch on/off installed plugins...

Improper Access Control in phpipam/phpipam

Description In phpIPAM 1.4.5, a normal user with the role of User could download or export IP subnets that may contain sensitive information related data such as IP address, IP state, MAC, owner, hostname and device via export-subnet.php endpoint. The bug is the export-subnet.php should verify th...

CVE-2021-46088

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution RCE. Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user...

CVE-2021-46088

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution RCE. Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user...

CVE-2021-46088

Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution RCE. Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user...

WordPress AdSanity premium plugin <= 1.8.1 - Broken Access Control vulnerability

Broken Access Control vulnerability leading to Arbitrary File Upload Contributor user role discovered by Jerome Bruandet in WordPress AdSanity premium plugin versions = 1.8.1. Solution Update the WordPress AdSanity premium plugin to the latest available version at least 1.8.2. Vulnerability autho...

WordPress WPFront User Role Editor plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress WPFront User Role Editor plugin has a cross-site scripting vulnerability in versions prior to...

CVE-2021-24984

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-24984

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-24984

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting...