CVE-2023-30491: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.8 versions...

July 26, 2023—KB5028254 (OS Build 22621.2070) Preview

None None...

Cross site scripting in widgets with units

Date : 2023-07-25 CVE ID : CVE-2023-36806 Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview back end and on the website front end. Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability...

WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Software CodeBard's Patron Button and Widgets for Patreon Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.1.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30491 Patch priority Medium CVSS severity Medium 7.1 Developer Codebard PSID 9bd81d51b303...

WordPress BlogPost - BlogPost Widgets - Amazing Blog Layouts Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software BlogPost - BlogPost Widgets - Amazing Blog Layouts Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 694940615fc3 Credits Rafie...

WordPress WP News and Scrolling Widgets Plugin <= 3.3.4 is vulnerable to Cross Site Scripting (XSS)

Software WP News and Scrolling Widgets Type Plugin Vulnerable versions = 3.3.4 Fixed in 4.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID c0214c70fb9b Credits Rafie Muhammad Patchstac...

WordPress Widgets on Pages Plugin < 1.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Widgets on Pages Type Plugin Vulnerable versions 1.8.1 Fixed in 1.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1d4d2801eca1 Credits Rafie Muhammad Patchstack Require...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin < 1.5.75 is vulnerable to Cross Site Scripting (XSS)

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions 1.5.75 Fixed in 1.5.75 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Unlimited Elements PSID...

WordPress Livemesh SiteOrigin Widgets Plugin < 3.3 is vulnerable to Cross Site Scripting (XSS)

Software Livemesh SiteOrigin Widgets Type Plugin Vulnerable versions 3.3 Fixed in 3.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a6f49c9df0d3 Credits Rafie Muhammad Patchstack...

WordPress Turbo Widgets Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Turbo Widgets Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 87b08b4531c7 Credits Rafie Muhammad Patchstack Required...

WordPress Pinblocks — Gutenberg blocks with Pinterest widgets Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Pinblocks — Gutenberg blocks with Pinterest widgets Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ba6810972139 Credit...

WordPress Widgets for SiteOrigin Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)

Software Widgets for SiteOrigin Type Plugin Vulnerable versions = 1.4.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 717d2bce0621 Credits Rafie Muhammad Patchstack...

WordPress Ultimate Widgets Light Plugin <= 1.5.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Widgets Light Type Plugin Vulnerable versions = 1.5.9.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4e4e4e84fe6c Credits Rafie Muhammad Patchstack...

WordPress Contact Widgets For Elementor Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

Software Contact Widgets For Elementor Type Plugin Vulnerable versions = 1.0.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5b33610fc779 Credits Rafie Muhammad...

WordPress Press Elements – Widgets for Elementor Plugin <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Press Elements – Widgets for Elementor Type Plugin Vulnerable versions = 1.7.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3a46109acff0 Credits Rafie...

WordPress Widgets on Pages and Posts Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)

Software Widgets on Pages and Posts Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3926c44f28d9 Credits Rafie Muhammad Patchstack...

WordPress ConeBlog – WordPress Blog Widgets Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)

Software ConeBlog – WordPress Blog Widgets Type Plugin Vulnerable versions = 1.4.7 Fixed in 1.4.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer WP Cone PSID 46d2d31b4e72 Credits Rafie Muhammad...

WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.2 is vulnerable to Broken Access Control

Software Cryptocurrency Widgets – Price Ticker & Coins List Type Plugin Vulnerable versions = 2.6.2 Fixed in 2.6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36681 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ec249fa35f9a...

CVE-2023-32532

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535...

CVE-2023-32533

Certain dashboard widgets on Trend Micro Apex Central on-premise are vulnerable to cross-site scripting XSS attacks that may allow an attacker to achieve remote code execution on affected servers. This is similar to, but not identical to CVE-2023-32531 through 32535...