Widget Shortcode <= 0.3.5 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...

CVE-2018-14959

An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI...

CVE-2018-14877

WeaselCMS v0.3.5 is affected by a cross-site scripting (XSS) vulnerability on the SETTINGS page. The issue allows injection of JavaScript through the Site Language, Site Title, Site Description, and Site Keywords fields. Some sources describe the attack as remote and exploitative via the affected...