PT-2024-27863 · Unknown · Meks Smart Author Widget

Name of the Vulnerable Software and Affected Versions: Meks Smart Author Widget versions 1.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

WordPress ArtPlacer Widget plugin < 2.21.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin ArtPlacer Widget versions 2.21.2...

WordPress ArtPlacer Widget plugin < 2.21.2 - Subscriber+ Arbitrary Widget Deletion vulnerability

Subscriber+ Arbitrary Widget Deletion vulnerability discovered by Bob Matyas in WordPress Plugin ArtPlacer Widget versions 2.21.2...

CVE-2023-7268

The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as subscriber, to delete arbitrary widgets...

CVE-2023-7268

The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as subscriber, to delete arbitrary widgets...

CVE-2023-7269 ArtPlacer Widget < 2.21.2 - Stored XSS via CSRF

The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2023-7269 ArtPlacer Widget < 2.21.2 - Stored XSS via CSRF

The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2023-7269

The ArtPlacer Widget WordPress plugin, in versions prior to 2.21.2 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing CSRF checks and inadequate input sanitization or escaping. This flaw allows an unauthenticated attacker to trick a logged-in administrator into adding St...

CVE-2023-7268

The ArtPlacer Widget WordPress plugin (versions prior to 2.21.2 ) is vulnerable to a Broken Access Control issue due to a lack of authorization checks when deleting widgets. This flaw allows any authenticated user, such as one with subscriber privileges, to delete arbitrary widgets. The vulnerabi...

CVE-2023-7268 ArtPlacer Widget < 2.21.2 - Subscriber+ Arbitrary Widget Deletion

The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as subscriber, to delete arbitrary widgets...

CVE-2023-7268 ArtPlacer Widget < 2.21.2 - Subscriber+ Arbitrary Widget Deletion

The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as subscriber, to delete arbitrary widgets...

WordPress ArtPlacer Widget Plugin < 2.21.2 is vulnerable to Broken Access Control

Software ArtPlacer Widget Type Plugin Vulnerable versions 2.21.2 Fixed in 2.21.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-7268 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 225caa001d36 Credits Bob Matyas Required privilege...

WordPress ArtPlacer Widget Plugin < 2.21.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software ArtPlacer Widget Type Plugin Vulnerable versions 2.21.2 Fixed in 2.21.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-7269 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID a04f7e509db4 Credits Bob Matyas Required...

PT-2024-15260 · WordPress · Artplacer Widget

Name of the Vulnerable Software and Affected Versions: ArtPlacer Widget WordPress plugin versions prior to 2.21.2 Description: The issue concerns a lack of authorization checks when deleting widgets, allowing any authenticated users, such as subscribers, to delete arbitrary widgets...

PT-2024-15261 · WordPress · Artplacer Widget

Name of the Vulnerable Software and Affected Versions: ArtPlacer Widget WordPress plugin versions prior to 2.21.2 Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS...

CVE-2024-6455

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capability checks on ekitwidgetareacontent function. This makes it possible for unauthenticated attackers to view any item created in Elementor,...

CVE-2024-5582

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attribute...

XenForo 2.2.15 Cross Site Request Forgery Vulnerability

------------------------------------------------------------------------------- XenForo = 2.2.15 Widget::actionSave Cross-Site Request Forgery Vulnerability ------------------------------------------------------------------------------- - Software Link: https://xenforo.com - Affected Versions:...

CVE-2024-3587

The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-3587

CVE-2024-3587 affects Premium Portfolio Features for Phlox theme (WordPress). The vulnerability is a Stored XSS in the Grid Portfolios Widget present in all versions up to and including 2.3.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation ...