PT-2022-13171

Name of the Vulnerable Software and Affected Versions White Label CMS WordPress plugin versions prior to 2.2.9 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the wlcms login custom js parameter is not properly sanitised and validated before being...

CVE-2022-0422: Improper Neutralization of Input During Web Page Generation

The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue...

White Label CMS <= 1.5.2 - Stored XSS

Due to a lack of CSRF protection, and lack of sanitation of user input, it is possible to trigger a Persistent XSS attack via a CSRF attack. This attack targets in particular the Import functionality, which is located in the 'wlcmsImport' function, within the file...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...

CVE-2012-5387

Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...

CVE-2012-5387

The CVE-2012-5387 entry refers to a CSRF vulnerability in the White Label CMS WordPress plugin (wlcms-plugin.php) before version 1.5.1. The underlying flaw allows remote attackers to hijack administrator authentication by submitting a request to wp-admin/admin.php with the wlcms_o_developer_name ...

CVE-2012-5388

CVE-2012-5388 is an XSS vulnerability in the White Label CMS plugin for WordPress (wlcms-plugin.php) version 1.5. It allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter during a save action to wp-admin/admin.php. This is relat...

CVE-2012-5388: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcmsodevelopername parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-53...

PT-2012-5969

Name of the Vulnerable Software and Affected Versions White Label CMS plugin versions prior to 1.5.1 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms o developer nam...

PT-2012-5970

Name of the Vulnerable Software and Affected Versions White Label CMS plugin version 1.5 for WordPress Description A cross-site scripting XSS issue allows remote authenticated administrators to inject arbitrary web script or HTML. This is achieved via the wlcms o developer name parameter in a sav...

WordPress White Label CMS Plugin <= 1.5 - XSS

Because of this vulnerability in wlcms-plugin.php, the authenticated administrators can inject arbitrary web script or HTML via the "wlcmsodevelopername" parameter. Solution Update the plugin...