7103 matches found
CVE-2024-10055 Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode
The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaiosnapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes...
WordPress RSS Feed Widget plugin <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via rfw-youtube-videos Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin RSS Feed Widget versions = 2.9.9...
PT-2024-33375 · Unknown · Adif Log Search Widget
Name of the Vulnerable Software and Affected Versions: ADIF Log Search Widget versions 1.0f and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Reflected XSS in the ADIF Log Search Widget...
PT-2024-16001 · WordPress · Rss Feed Widget
Name of the Vulnerable Software and Affected Versions: RSS Feed Widget plugin for WordPress versions up to, and including, 2.9.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode due to insufficient input sanitization and output escapin...
PT-2024-33378 · Agustin Berasategui · Ab Categories Search Widget
Name of the Vulnerable Software and Affected Versions: Agustin Berasategui AB Categories Search Widget versions 0.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS...
PT-2024-39915 · WordPress · Elementinvader Addons For Elementor
Name of the Vulnerable Software and Affected Versions: ElementInvader Addons for Elementor plugin for WordPress versions up to, and including, 1.2.9 Description: The issue allows authenticated attackers with contributor-level access and above to view private, draft, and password-protected posts,...
WordPress plugin Add Widget After Content 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...
WordPress plugin ADIF Log Search Widget 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress plugin RSS Feed Widget 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
WordPress RSS Feed Widget Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)
Software RSS Feed Widget Type Plugin Vulnerable versions = 2.9.9 Fixed in 3.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10057 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d0b0d19c49ad Credits Peter Thaleikis Require...
CVE-2024-49281
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in NinjaTeam Click to Chat – WP Support All-in-One Floating Widget allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through 2.3.3...
WordPress Add Widget After Content plugin <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by ghsinfosec in WordPress Plugin Add Widget After Content versions = 2.4.6...
CVE-2024-48048
Cross-Site Request Forgery CSRF vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through = 1.0...
CVE-2024-48037
Cross-Site Request Forgery CSRF vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through = 1.4.2...
CVE-2024-48023
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rconnect305 Restaurant Reservations Widget restaurantconnect-reswidget allows Reflected XSS.This issue affects Restaurant Reservations Widget: from n/a through = 1.0...
CVE-2024-48023
CVE-2024-48023 is a Reflected XSS in the WordPress plugin Restaurant Reservations Widget (versions <= 1.0). The vulnerability stems from improper neutralization of input during web page generation, enabling Reflected XSS as described in multiple sources. The affected product is the Restaurant ...
CVE-2024-48048 WordPress Wsify Widget plugin <= 1.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through = 1.0...
CVE-2024-48048 WordPress Wsify Widget plugin <= 1.0 - CSRF to Stored XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through = 1.0...
CVE-2024-48048
CVE-2024-48048 : WordPress Wsify Widget (
CVE-2024-48037
CVE-2024-48037 concerns the WordPress plugin Contact Form Widget (Contact Form Widget: Contact Query, Contact Page, Form Maker, Query Table) with versions 1.4.2 and earlier. The vulnerability is a CSRF flaw that could allow unauthorized state-changing requests from authenticated or possibly unaut...