| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, allowing Author-level users to set the malicious delay value via XML-RPC custom_fields when creating an ml-slider post. |
| The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting. |
| The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account. |
| The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin. |
| Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions. |
| Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Popup Maker <= 1.23.0 versions. |
| Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions. |
| Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions. |
| Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions. |
| Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions. |
| Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. |
| Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. |
| Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions. |
| Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. |
| Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. |
| Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. |
