Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin = 1.6 versions...

CVE-2023-25036

CVE-2023-25036 affects the WordPress Social Media Icons Widget plugin (≤1.6). The CSRF vulnerability allows unauthenticated users to exploit but no patch is publicly available (patch status is unpatched per multiple sources; PatchStack lists no fix). Affected plugin versions should be considered ...

CVE-2023-25036 WordPress Social Media Icons Widget Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin = 1.6 versions...

CVE-2023-25036 WordPress Social Media Icons Widget Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin = 1.6 versions...

WordPress Blog Sidebar Widget Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Blog Sidebar Widget Type Plugin Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7ae8bbf8a06a Credits Rafie Muhammad Patchstack...

WordPress Flight Search Widget and Blocks Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Flight Search Widget and Blocks Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 492a34dd0ab4 Credits Rafie Muhammad...

WordPress Widget for Contact form 7 Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Widget for Contact form 7 Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a604b9189b17 Credits Rafie Muhammad Patchstac...

CVE-2023-25036: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin = 1.6 versions...

WordPress Simple Social Page Widget & Shortcode Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Simple Social Page Widget & Shortcode Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0903d51f92c2 Credits Rafie Muhamm...

WordPress Widget Detector for Elementor Plugin < 1.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Widget Detector for Elementor Type Plugin Vulnerable versions 1.2.5 Fixed in 1.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0162598352f7 Credits Rafie Muhammad...

WordPress Tabs with Recommended Posts (Widget) Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Tabs with Recommended Posts Widget Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a781c6b9a217 Credits Rafie Muhammad...

PT-2023-19886 · WordPress · Ankit Social Media Icons Widget

Name of the Vulnerable Software and Affected Versions: a.Ankit Social Media Icons Widget plugin versions 1.6 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

WordPress Hire Me Widget Plugin < 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Hire Me Widget Type Plugin Vulnerable versions 1.0.5 Fixed in 1.0.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3fd9a7440ccd Credits Rafie Muhammad Patchstack Required...

WordPress Video Reviews / Video Widget Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Video Reviews / Video Widget Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7dac09181d24 Credits Rafie Muhammad...

WordPress Rating Widget Plugin < 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Rating Widget Type Plugin Vulnerable versions 3.2.0 Fixed in 3.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Rating-Widget PSID fd73e6791148 Credits Rafie Muhammad Patchstack Required...

WordPress Cool Author Box - For Widget and Post Content Plugin <= 2.9.5 is vulnerable to Cross Site Scripting (XSS)

Software Cool Author Box - For Widget and Post Content Type Plugin Vulnerable versions = 2.9.5 Fixed in 2.9.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 965a0456c07b Credits...

WordPress Post Slider and Carousel with Widget – A Responsive Post Slider Plugin < 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Post Slider and Carousel with Widget – A Responsive Post Slider Type Plugin Vulnerable versions 3.2.1 Fixed in 3.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

CVE-2023-3245

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3245 Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3245 Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...