WordPress Dashboard Widgets Suite Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Dashboard Widgets Suite Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-26517 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b0d81df240e3 Credits Rio Darmawan...

Dashboard Widgets Suite < 3.2.2 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

azureml_widgets (>=1.0.0 <=1.0.6) potentially affected by CVE-2021-32860 via izimodal (=1.5.1)

izimodal NPM version =1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on izimodal and may be impacted: - azuremlwidgets =1.0.0, =1.0.6 Source cves: CVE-2021-32860 Source advisory: OSV:GHSA-H685-83W4-3PH3...

CVE-2022-4785

The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4785

The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4785 Download Video Sidebar Widgets <= 6.1 - Contributor+ Stored XSS via Shortcode

The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4785 Download Video Sidebar Widgets <= 6.1 - Contributor+ Stored XSS via Shortcode

The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4785

The CVE-2022-4785 entry concerns the Video Sidebar Widgets WordPress plugin (versions

WordPress Plugin Download Video Sidebar Widgets 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2020-21119

CVE-2020-21119 refers to a SQL Injection vulnerability in Kliqqi-CMS 2.0.2. The issue resides in admin/admin_update_module_widgets.php, specifically in the recordIDValue parameter, enabling an attacker to gain escalated privileges and execute arbitrary code. The available connected documents cons...

CVE-2022-4488

The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege use...

CVE-2022-4488

The CVE (CVE-2022-4488) affects the WordPress Widgets on Pages plugin older than 1.8.0. The issue is that shortcode attributes are not validated or escaped before being echoed, enabling Stored XSS that could target high-privilege admins, with any contributor-level user potentially triggering payl...

CVE-2022-4488 Widgets on Pages < 1.8.0 - Contributor+ Stored XSS

The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege use...

PT-2023-14565 · WordPress · Widgets On Pages

Name of the Vulnerable Software and Affected Versions: Widgets on Pages WordPress plugin versions prior to 1.8.0 Description: The issue concerns the failure to validate and escape shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scriptin...

WordPress plugin Widgets on Pages 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CKEditor 跨站脚本漏洞

CKEditor is an open source, web-based text editor. A cross-site scripting vulnerability exists in CKEditor5 that stems from the inability of CKEditor5's widgets to clean up user-supplied data...

CVE-2022-4824

The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

CVE-2022-4824

The CVE-2022-4824 entry concerns the WordPress plugin WP Blog and Widgets (before version 2.3.1). Multiple sources confirm a Stored XSS vulnerability caused by not validating and escaping certain shortcode attributes, enabling users with as low as Contributor to target high-privilege admins. The ...

CVE-2022-4824 WP Blog and Widget < 2.3.1 - Contributor+ Stored XSS via Shortcode

The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

WordPress plugin WP Blog and Widgets 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...