Security
Headlines
HeadlinesLatestCVEs

Tag

#wordpress

CVE-2022-38467: WordPress CRM Perks Forms plugin <= 1.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.

CVE
#xss#vulnerability#web#wordpress
CVE-2023-0294: sidebar.php in mediamatic/trunk/inc – WordPress Plugin Repository

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on its AJAX actions function. This makes it possible for unauthenticated attackers to change image categories used by the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE-2023-0295: settings.php in launchpad-by-obox/tags/1.0.13/functions – WordPress Plugin Repository

The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

WordPress Slider Revolution 4.6.5 Directory Traversal

WordPress Slider Revolution plugin version 4.6.5 suffers from a directory traversal vulnerability.