Security
Headlines
HeadlinesLatestCVEs

Tag

#wordpress

CVE-2023-27432: WordPress Manage Upload Limit plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WpSimpleTools Manage Upload Limit plugin <= 1.0.4 versions.

CVE
Open in Source
#xss#vulnerability#web#wordpress#auth
CVE-2023-27414: WordPress Popup box plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Popup Box Team Popup box plugin <= 3.4.4 versions.

CVE-2023-27450: WordPress Leyka plugin <= 3.29.2 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions.

CVE-2023-27443: WordPress Simple Vimeo Shortcode plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Grant Kimball Simple Vimeo Shortcode plugin <= 2.9.1 versions.

CVE-2023-27439: WordPress New Adman plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gl_SPICE New Adman plugin <= 1.6.8 versions.

CVE-2023-35095: WordPress Flo Forms plugin <= 1.0.40 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flothemes Flo Forms – Easy Drag & Drop Form Builder plugin <= 1.0.40 versions.

WordPress Theme Medic 1.0.0 Weak Password Recovery Mechanism

WordPress Theme Medic theme version 1.0.0 suffers from having a weak password recovery mechanism for the forgot password flow.

WordPress Kero jQuery/HTML Dashboard PRO 2.3.86 SQL Injection

WordPress Kero jQuery/HTML Dashboard PRO theme version 2.3.86 suffers from a remote SQL injection vulnerability that allows for authentication bypass.