Fattura24 < 6.2.8 - Reflected Cross-Site Scripting

Description The plugin does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability. wp-admin/options-general.php?page=fatt-24-tax&id=12alert1%3B...

Design/Logic Flaw

The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered...

CVE-2023-3604 Change WP Admin < 1.1.4 - Secret Login Page Disclosure

The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered...

CVE-2023-3604 Change WP Admin < 1.1.4 - Secret Login Page Disclosure

The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered...

CVE-2023-3604

CVE-2023-3604 affects the Change WP Admin Login WordPress plugin prior to version 1.1.4. The vulnerability arises from disclosing the URL of the hidden login page when a crafted URL is accessed, bypassing the plugin’s protection mechanism. Impact, as stated in multiple sources, is that an unauthe...

CVE-2023-3604: Undefined Security Weakness

The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered...

tagDiv Composer < 4.2 - Unauthenticated Stored XSS

Description The plugin, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scriptin...

WordPress Change wp-admin login Plugin < 1.1.4 is vulnerable to Bypass Vulnerability

Software Change wp-admin login Type Plugin Vulnerable versions 1.1.4 Fixed in 1.1.4 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-3604 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID f402f5411a8e Credits Muhamad Arsyad...

Change WP Admin < 1.1.4 - Secret Login Page Disclosure

Description The plugin discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered. - Set custom Login URL under "Settings Permalinks". For example, login - As an unauthenticated visitor, open https://example.com/wp-admin/customize.php in a different...

Change WP Admin < 1.1.4 - Secret Login Page Disclosure

Description The plugin discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered. PoC - Set custom Login URL under "Settings Permalinks". For example, login - As an unauthenticated visitor, open https://example.com/wp-admin/customize.php in a...

WordPress SnazzyAdmin WP Admin Theme Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software SnazzyAdmin WP Admin Theme Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e3611a722d35 Credits Rafie Muhammad Patchsta...

CVE-2023-3139

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered...

Design/Logic Flaw

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered...

CVE-2023-3139 Protect WP Admin < 4.0 - Unauthenticated Protection Bypass

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered...

CVE-2023-3139

The Protect WP Admin WordPress plugin (versions before 4.0 ) is vulnerable to an unauthenticated protection bypass (CWE-601). A design/logic flaw allows an attacker to discover the hidden URL of the admin panel by triggering a redirection via a crafted URL , effectively bypassing the plugin's int...

PT-2023-23296

Name of the Vulnerable Software and Affected Versions: Protect WP Admin WordPress plugin versions prior to 4.0 Description: The issue allows an attacker to disclose the URL of the admin panel via a redirection of a crafted URL, effectively bypassing the protection offered by the plugin...

CVE-2023-3139: URL Redirection to Untrusted Site

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered...

WordPress Protect WP Admin Plugin < 4.0 is vulnerable to Bypass Vulnerability

Software Protect WP Admin Type Plugin Vulnerable versions 4.0 Fixed in 4.0 OWASP Top 10 A5: Broken Access Control Classification Bypass Vulnerability CVE CVE-2023-3139 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 4511e654606c Credits Daniel Ruf Required privilege...

WordPress Plugin Page Builder: KingComposer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Page Builder: KingComposer...

HTTP Headers < 1.18.8 - Admin+ SQL Injection

This plugin has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability. PoC 1. Create an SQL file with the following contents: UPDATE wpoptions SET optionvalue = "Hacked" WHERE optionname = "blogname" 2. As an admin user within WP Admin,...