496 matches found
CVE-2023-32964
Cross-Site Request Forgery CSRF vulnerability in Made with Fuel Better Notifications for WP plugin = 1.9.2 versions...
PT-2023-19117 · WordPress · Rvola Wp Original Media Path
Name of the Vulnerable Software and Affected Versions: RVOLA WP Original Media Path plugin versions = 2.4.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious script execution on t...
PT-2023-15419 · WordPress · Jeffrey-Wp Media Library Categories
Name of the Vulnerable Software and Affected Versions: Jeffrey-WP Media Library Categories plugin versions prior to 1.9.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For...
CVE-2023-1088
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
Cross site request forgery (csrf)
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
CVE-2023-1088 WP Plugin Manager < 1.1.8 - Arbitrary Plugin Activation via CSRF
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
CVE-2023-1088
CVE-2023-1088 affects WP Plugin Manager for WordPress prior to 1.1.8. The root cause is missing CSRF validation on plugin activation, enabling CSRF attackers to trigger activation of arbitrary plugins by logged-in admins. Public details consistently identify the vulnerable release range and the f...
CVE-2023-1088: Undefined Security Weakness
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
CVE-2022-38063
Cross-Site Request Forgery CSRF vulnerability in Social Login WP plugin = 5.0.0.0 versions...
CVE-2022-38063
CVE-2022-38063 is a CSRF vulnerability reported in the WordPress plugin Social Login WP, affecting versions <= 5.0.0.0. The initial and connected sources consistently describe a Cross-Site Request Forgery issue in this plugin. The documents do not specify explicit exploitation steps or in-the-...
CVE-2023-23711
Cross-Site Request Forgery CSRF vulnerability in A2 Hosting A2 Optimized WP plugin = 3.0.4 versions...
CVE-2023-23711
CVE-2023-23711 concerns the A2 Hosting A2 Optimized WP plugin (
CVE-2022-33943
Authenticated contributor or higher user role Cross-Site Scripting XSS vulnerability in Nico Amarilla's BxSlider WP plugin = 2.0.0 at WordPress...
CVE-2022-33943
CVE-2022-33943: Authenticated Cross-Site Scripting (XSS) vulnerability in the WordPress BxSlider WP plugin, affecting versions
CVE-2022-33943: Improper Neutralization of Input During Web Page Generation
Authenticated contributor or higher user role Cross-Site Scripting XSS vulnerability in Nico Amarilla's BxSlider WP plugin = 2.0.0 at WordPress...
WordPress plugin FreeMind WP 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin FreeMind W...
CVE-2021-24949
The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection...
CVE-2021-36916 WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability
The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...
Sociable <= 4.3.4.1 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfilteredhtml capability is disallowed PoC Put the following payload in the...
Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS)
The plugin did not sanitise the calId GET parameter in the "Seasons & Calendars" page before outputing it in an A tag, leading to a reflected XSS issue Payloads: - Original reporter:...