CVE-2022-4541 WordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header

The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress WordPress Visitors plugin <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header vulnerability

Unauthenticated Stored Cross-Site Scripting via HTTP Header vulnerability discovered by rezaduty in WordPress Plugin nm-visitors versions = 1.0...

PT-2024-11712 · WordPress · Wordpress Visitors

Name of the Vulnerable Software and Affected Versions: WordPress Visitors plugin for WordPress version 1.0 Description: The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value due to insufficient input sanitization and output...

WordPress nm-visitors Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software nm-visitors Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4541 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 95398650de42 Credits rezaduty Required privileg...

AVMS Project 1.0 SQL Injection

============================================================================================================================================= | Title : AVMS Project 1.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 129.0.1 64 bits |...

CVE-2023-0714 Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in versions up to, and including, 3.2.4. This allows unauthenticated visitors to perform a "double extension" attack and upload files containing a malicious...

Cache Poisoning

typo3/cms is vulnerable to Cache Poisoning. The vulnerability is caused due to using the configuration option config.prefixLocalAnchors with values "all" or "cached". This can lead to unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the...

CVE-2024-3966

The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripting attacks that trigger when an admin visits the Prayer Requests in the WP Admin...

WP Visitors Tracker < 2.4 - Reflected Cross-Site Scripting

Description The WP Visitors Tracker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-35737 WordPress WP Visitors Tracker plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3...

CVE-2024-35737 WordPress WP Visitors Tracker plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3...

WordPress plugin WP Visitors Tracker Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-26689 · WordPress · Loopus Wp Visitors Tracker

Name of the Vulnerable Software and Affected Versions: Loopus WP Visitors Tracker versions n/a through 2.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. This can potentially...

CVE-2024-37160

Formwork is a flat file-based Content Management System CMS. An attackers requires administrator privilege to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages except the dashboard...

WordPress WP Visitors Tracker plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dave Jong Patchstack in WordPress Plugin WP Visitors Tracker versions = 2.3...

WordPress WP Visitors Tracker Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Visitors Tracker Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35737 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6ab9fca25607 Credits Dave Jong Patchstack Required...

GHSA-5J86-5XVG-7Q93 TYPO3 Cross-Site Scripting (XSS) in form component

Failing to sanitize content from unauthenticated website visitors, the form component is susceptible to Cross-Site Scripting...

CVE-2024-3641

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins...

CVE-2024-3641

The CVE-2024-3641 entry corresponds to the WordPress Newsletter Popup plugin (versions ≤ 1.2). The underlying issue is improper sanitisation/escaping of parameters, enabling unauthenticated stored Cross-Site Scripting (XSS) attacks against admins. Public advisories (NVD/NVD-enriched records, CVE ...

Newsletter Popup <= 1.2 - Unauthenticated Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins PoC 1. Make sure there is a newsletter configured with the setting "Email Service Save to local database" 2. When not logged in,...