9108 matches found
CVE-2024-10055 Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode
The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaiosnapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes...
WordPress RSS Feed Widget plugin <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via rfw-youtube-videos Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin RSS Feed Widget versions = 2.9.9...
PT-2024-33375 · Unknown · Adif Log Search Widget
Name of the Vulnerable Software and Affected Versions: ADIF Log Search Widget versions 1.0f and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Reflected XSS in the ADIF Log Search Widget...
PT-2024-39915 · WordPress · Elementinvader Addons For Elementor
Name of the Vulnerable Software and Affected Versions: ElementInvader Addons for Elementor plugin for WordPress versions up to, and including, 1.2.9 Description: The issue allows authenticated attackers with contributor-level access and above to view private, draft, and password-protected posts,...
PT-2024-15999
Name of the Vulnerable Software and Affected Versions Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress versions up to, and including, 2.3.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's wpsaio snapchat shortcode due to insufficient inpu...
WordPress plugin ADIF Log Search Widget has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-33378 · Agustin Berasategui · Ab Categories Search Widget
Name of the Vulnerable Software and Affected Versions: Agustin Berasategui AB Categories Search Widget versions 0.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS...
CVE-2024-49240: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ajberasategui AB Categories Search Widget ab-categories-search-widget allows Reflected XSS.This issue affects AB Categories Search Widget : from n/a through = 0.2.5...
CVE-2024-10057: Improper Neutralization of Input During Web Page Generation
The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-49238: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in emka73 ADIF Log Search Widget adif-log-search-widget allows Reflected XSS.This issue affects ADIF Log Search Widget: from n/a through = 1.0f...
CVE-2024-10055: Improper Neutralization of Input During Web Page Generation
The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaiosnapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes...
CVE-2024-9892: Improper Neutralization of Input During Web Page Generation
The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
WordPress RSS Feed Widget Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)
Software RSS Feed Widget Type Plugin Vulnerable versions = 2.9.9 Fixed in 3.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10057 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d0b0d19c49ad Credits Peter Thaleikis Require...
PT-2024-16001 · WordPress · Rss Feed Widget
Name of the Vulnerable Software and Affected Versions: RSS Feed Widget plugin for WordPress versions up to, and including, 2.9.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode due to insufficient input sanitization and output escapin...
WordPress Plugin RSS Feed Widget Cross-Site Script Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
WordPress plugin “Add Widget After Content” has a cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...
CVE-2024-49281
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in NinjaTeam Click to Chat – WP Support All-in-One Floating Widget allows Stored XSS.This issue affects Click to Chat – WP Support All-in-One Floating Widget: from n/a through 2.3.3...
WordPress Add Widget After Content plugin <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by ghsinfosec in WordPress Plugin Add Widget After Content versions = 2.4.6...
