WordPress plugin WPCS cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software WPCS Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51506 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 8263d2966a43 Credits Ngô Thiên An ancorn from VNPT-VCI Required...

CVE-2023-2558

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcscurrentcurrency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2023-2557

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...

Design/Logic Flaw

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...

Design/Logic Flaw

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcssddelete action in versions up to, and including, 1.1.9. This makes it possible for authenticated...

CVE-2023-2555

CVE-2023-2555 affects the WPCS – WordPress Currency Switcher Professional plugin for WordPress. The issue arises from a missing capability check on the create function in versions up to and including 1.1.9, enabling authenticated attackers with subscriber-level permissions and above to create a c...

CVE-2023-2557 WPCS – WordPress Currency Switcher Professional <= 1.1.9 - Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editing

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-2557

CVE-2023-2557 concerns the WPCS – WordPress Currency Switcher Professional plugin. The vulnerability is a missing capability check on the save function, allowing authenticated attackers with subscriber-level permissions or higher to modify an arbitrary custom drop-down currency switcher. Affected...

CVE-2023-2558

CVE-2023-2558 affects the WPCS – WordPress Currency Switcher Professional plugin for WordPress. It is a stored Cross‑Site Scripting (XSS) vulnerability in the wpcs_current_currency shortcode, caused by insufficient input sanitization and output escaping on user-supplied attributes. Affected versi...

CVE-2023-2556

CVE-2023-2556 involves the WPCS – WordPress Currency Switcher Professional plugin for WordPress (≤ 1.1.9). The vulnerability is a missing capability check in the wpcs_sd_delete action, enabling authenticated users with subscriber-level permissions and above to delete an arbitrary custom drop-down...

CVE-2023-2557: Missing Authorization

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2023-2556: Missing Authorization

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcssddelete action in versions up to, and including, 1.1.9. This makes it possible for authenticated...

CVE-2023-2558: Improper Neutralization of Input During Web Page Generation

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcscurrentcurrency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2023-2555: Missing Authorization

The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level...

WordPress WPCS Plugin <= 1.1.9 is vulnerable to Broken Access Control

Software WPCS Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2556 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 05cf802e36e5 Credits Alex Thomas Required privilege...

WordPress WPCS Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software WPCS Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2558 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d4269971d7d0 Credits Alex Thomas Required privileg...

CVE-2021-20780

Cross-site request forgery CSRF vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2021-20780

CVE-2021-20780 affects the WordPress plugin WPCS – WordPress Currency Switcher (versions 1.1.6 and earlier). The vulnerability is a Cross-site Request Forgery (CSRF) that can allow an attacker, while a logged-in admin views a malicious page, to perform unintended actions and hijack administrator ...

CVE-2021-20780

Cross-site request forgery CSRF vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...