CVE-2021-24530: Improper Neutralization of Input During Web Page Generation

The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress 插件 跨站脚本漏洞

WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Alojapro Widget 1.1.15 and earlier versions, which stems from the plugin not properly cleaning up its custom CSS settings, allowing an elevated privilege user t...

PT-2021-16052

Name of the Vulnerable Software and Affected Versions Alojapro Widget WordPress plugin versions 1.1.15 and earlier Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to improper sanitization of Custom CSS settings, even when the unfiltered html capabilit...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-94153)

WordPress is a PHP, MySQL and JavaScript based project and uses Node as its JavaScript dependency. A native development environment is available for getting up and running quickly. An XSS vulnerability exists in WordPress in version 5.8 beta 1, which is related to the affected version not properl...

CVE-2021-39202

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...

Double free

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...

UBUNTU-CVE-2021-39202

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...

CVE-2021-39202

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...

CVE-2021-38322

The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1...

CVE-2021-38322

The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1...

CVE-2021-38322 Twitter Friends Widget <= 3.1 Reflected Cross-Site Scripting

The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1...

CVE-2021-38322 Twitter Friends Widget <= 3.1 Reflected Cross-Site Scripting

The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1...

CVE-2021-38322

The CVE concerns the Twitter Friends Widget WordPress plugin (versions up to 3.1) and is a Reflected Cross-Site Scripting (XSS) vulnerability triggered via the pmc_TF_user and pmc_TF_password parameters in ~/twitter-friends-widget.php. Affected component: WordPress plugin code handling these inpu...

WordPress 插件跨站脚本漏洞

WordPress is a PHP, MySQL and JavaScript based project and uses Node as its JavaScript dependency. A native development environment is available for getting up and running quickly. An XSS vulnerability exists in WordPress in version 5.8 beta 1, which is related to the affected version not properl...

PT-2021-4498 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions 5.8 beta 1 through 5.8 Description: The issue is related to improper handling of HTML input in the Custom HTML feature of the widgets editor, introduced in WordPress 5.8 beta 1. This leads to stored XSS in the custom HTML...

PT-2021-22040

Name of the Vulnerable Software and Affected Versions: Twitter Friends Widget WordPress plugin versions up to and including 3.1 Description: The issue allows attackers to inject arbitrary web scripts via the pmc TF user and pmc TF password parameters found in the /twitter-friends-widget.php file...

CVE-2021-38322: Improper Neutralization of Input During Web Page Generation

The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability in the WordPress plugin Twitter Friends Widget, which originate...

WordPress Twitter Friends Widget plugin <= 3.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Twitter Friends Widget plugin versions = 3.1. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

Twitter Friends Widget <= 3.1 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts...