CVE-2023-3254: Cross-Site Request Forgery (CSRF)

The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setupnoregheader.php. This makes it possible for unauthenticated attackers to reset plugin settings a...

WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection

Software Responsive Column Widgets Type Plugin Vulnerable versions = 1.2.7 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2023-45762 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 59d95f8609d5 Credits Phd Required privilege...

Malicious code in @zpp/campaign-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bf91721d9ccb3de458db5333c68a7144fbf85950c53ad2ee5c0086124814a1cd The OpenSSF Package Analysis project identified '@zpp/campaign-widgets' @ 10.9.2 npm as malicious. It is considered malicious because: - The...

MAL-2023-8288 Malicious code in @zpp/campaign-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bf91721d9ccb3de458db5333c68a7144fbf85950c53ad2ee5c0086124814a1cd The OpenSSF Package Analysis project identified '@zpp/campaign-widgets' @ 10.9.2 npm as malicious. It is considered malicious because: - The...

Malicious code in @atbdigitalteam/ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2756dc0ffc0a9cddcb70299b7fc1cb3722a348f93647bf237c1f130ecb60ff02 The OpenSSF Package Analysis project identified '@atbdigitalteam/ui-widgets' @ 2.4.1 npm as malicious. It is considered malicious because: - The...

Store XSS in Widgets and pages in instantsoft/icms2

Description I noticed that you filtered the filter very carefully. But there are still some parts you missed Proof of Concept 1 . Login with admin 2 . Go to "http://localhost/o2/admin/menu/itemedit/18" 3 . Insert payload in CSS class 4 . Click save , and go to home page, and Detect store xss in...

Magento XML Injection vulnerability in the Widgets Update Layout

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

GHSA-8CJG-F53M-8M9Q Magento XML Injection vulnerability in the Widgets Update Layout

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-36023

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

Input validation

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-36023: Improper Neutralization of Special Elements used in an OS Command

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

PT-2023-36454

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

Store XSS in Widgets and pages

Description I noticed that you filtered the comment very carefully. But there are still some parts you missed Proof of Concept 1 .Login with admin 2 .Go to "https://demo.instantcms.io/admin/widgets" 3 . Insert payload in Position name and Title test" onmouseover = "alertdocument.cookie 4 .Click...

CSZ CMS 跨站脚本漏洞

CSZ CMS is an open source PHP-based content management system CMS. A security vulnerability exists in CSZ CMS version 1.3.0, which can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload entered in the Carousel Wiget and via rotating widgets created on top of...

CodeBard's Patron Button and Widgets for Patreon < 2.1.9 - Reflected XSS

Description The plugin does not sanitise and escape the siteaccount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-30491

Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.8 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.8 versions...

CVE-2023-30491 WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.8 versions...

CVE-2023-30491

CVE-2023-30491 is an unauthenticated reflected XSS in CodeBard's Patron Button and Widgets for Patreon WordPress plugin (versions

PT-2023-22727 · Codebard · Patron Button/Widgets For Patreon

Name of the Vulnerable Software and Affected Versions: CodeBard's Patron Button and Widgets for Patreon plugin versions = 2.1.8 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scrip...