CVE-2023-7083

The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

Cross site request forgery (csrf)

The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

Cross site scripting

The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks...

CVE-2023-7083 Voting Record <= 2.0 - Settings Update to Stored XSS via CSRF

The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2023-7083

The CVE-2023-7083 entry concerns the Voting Record WordPress plugin (≤2.0). The issue arises from missing CSRF checks in certain areas and lack of sanitisation/escaping, enabling a logged-in administrator to store XSS payloads via CSRF. The description notes potential Stored XSS through a CSRF at...

CVE-2023-7084 Voting Record <= 2.0 - Subscriber+ Stored XSS

The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks...

CVE-2023-7084 Voting Record <= 2.0 - Subscriber+ Stored XSS

The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks...

CVE-2023-7084

CVE-2023-7084 affects the Voting Record WordPress plugin up to version 2.0. It enables Stored XSS via authenticated users (e.g., subscribers) due to missing sanitisation and escaping in the voting data handling. The Wordfence Intelligence entry notes an unpatched status for this vulnerability, an...

WordPress plugin Voting Record security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Voting Record security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-7083: Cross-Site Request Forgery (CSRF)

The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

PT-2024-15205

Name of the Vulnerable Software and Affected Versions The Voting Record WordPress plugin versions 2.0 and earlier Description The issue is related to the lack of CSRF check in some places, as well as missing sanitisation and escaping, which could allow attackers to make logged-in admins add Store...

PT-2024-15206

Name of the Vulnerable Software and Affected Versions Voting Record WordPress plugin versions 2.0 and earlier Description The issue is related to missing sanitisation and escaping in the Voting Record WordPress plugin, which could allow any authenticated users, such as subscribers, to perform...

CVE-2023-7084: Improper Neutralization of Input During Web Page Generation

The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks...

WordPress Voting Record Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Voting Record Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-7083 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 6107adacfb26 Credits Daniel Ruf Required...

WordPress Voting Record Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Voting Record Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7084 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4244145376c3 Credits Daniel Ruf Required...

Voting Record <= 2.0 - Subscriber+ Stored XSS

Description The plugin is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks PoC Have a subscriber open an HTML file containing the following: See the XSS when logged in as an admin and viewing recorded votes...

Voting Record <= 2.0 - Subscriber+ Stored XSS

Description The plugin is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks Have a subscriber open an HTML file containing the following: ' ' document.forms0.submit; See the XSS when logged in as an admin and...

Olas can be locked less than 1 week

Lines of code Vulnerability details Impact The minimum lock time for OLAS is 1 week. If a user locks their OLAS for a duration less than that, their voting power becomes zero. However, in OLAS:createLockFor, the system only checks if the unlockTime is greater than the block.timestamp. Consequentl...

griefer can create maximum length time locks for other users with only dust

Lines of code Vulnerability details Description veOLAS is the voting token for the OLAS protocol. It functions like the curve.fi voting token in that a user gets more votes the longer they lock their tokens. A user can create a lock for themselves or have another user create a lock for them, usin...