WordPress Live Gold Price & Silver Price Charts Widgets Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS)

Software Live Gold Price & Silver Price Charts Widgets Type Plugin Vulnerable versions = 2.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47662 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 58de0e2ba596 Credi...

WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)

Software CodeBard's Patron Button and Widgets for Patreon Type Plugin Vulnerable versions = 2.1.9 Fixed in 2.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47524 Patch priority High CVSS severity High 5.8 Developer Codebard PSID 00014dfb79a5...

WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Column Widgets Type Plugin Vulnerable versions = 1.2.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47520 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b88d78460aae Credits Le Ngoc A...

CVE-2023-3254 Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset

The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setupnoregheader.php. This makes it possible for unauthenticated attackers to reset plugin settings a...

CVE-2023-3254

CVE-2023-3254 – Widgets for Google Reviews (WordPress) Technical details from connected sources confirm a CSRF vulnerability in versions up to 10.9 due to missing or incorrect nonce validation in setup_no_reg_header.php. This enables unauthenticated attackers to trigger forged requests that reset...

CVE-2023-3254: Cross-Site Request Forgery (CSRF)

The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setupnoregheader.php. This makes it possible for unauthenticated attackers to reset plugin settings a...

WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection

Software Responsive Column Widgets Type Plugin Vulnerable versions = 1.2.7 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2023-45762 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 59d95f8609d5 Credits Phd Required privilege...

MAL-2023-8288 Malicious code in @zpp/campaign-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bf91721d9ccb3de458db5333c68a7144fbf85950c53ad2ee5c0086124814a1cd The OpenSSF Package Analysis project identified '@zpp/campaign-widgets' @ 10.9.2 npm as malicious. It is considered malicious because: - The...

Malicious code in @zpp/campaign-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bf91721d9ccb3de458db5333c68a7144fbf85950c53ad2ee5c0086124814a1cd The OpenSSF Package Analysis project identified '@zpp/campaign-widgets' @ 10.9.2 npm as malicious. It is considered malicious because: - The...

Malicious code in @atbdigitalteam/ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2756dc0ffc0a9cddcb70299b7fc1cb3722a348f93647bf237c1f130ecb60ff02 The OpenSSF Package Analysis project identified '@atbdigitalteam/ui-widgets' @ 2.4.1 npm as malicious. It is considered malicious because: - The...

Store XSS in Widgets and pages in instantsoft/icms2

Description I noticed that you filtered the filter very carefully. But there are still some parts you missed Proof of Concept 1 . Login with admin 2 . Go to "http://localhost/o2/admin/menu/itemedit/18" 3 . Insert payload in CSS class 4 . Click save , and go to home page, and Detect store xss in...

GHSA-8CJG-F53M-8M9Q Magento XML Injection vulnerability in the Widgets Update Layout

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

Magento XML Injection vulnerability in the Widgets Update Layout

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-36023

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

Input validation

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

PT-2023-36454

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-36023: Improper Neutralization of Special Elements used in an OS Command

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

Store XSS in Widgets and pages

Description I noticed that you filtered the comment very carefully. But there are still some parts you missed Proof of Concept 1 .Login with admin 2 .Go to "https://demo.instantcms.io/admin/widgets" 3 . Insert payload in Position name and Title test" onmouseover = "alertdocument.cookie 4 .Click...

CSZ CMS 跨站脚本漏洞

CSZ CMS is an open source PHP-based content management system CMS. A security vulnerability exists in CSZ CMS version 1.3.0, which can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload entered in the Carousel Wiget and via rotating widgets created on top of...

CodeBard's Patron Button and Widgets for Patreon < 2.1.9 - Reflected XSS

Description The plugin does not sanitise and escape the siteaccount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...