Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

 Verified

 Fixed

**4.7**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 7.3.10

PSID 

193de4e964ae

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

If "Require User Login" is set to "No" , the XSS will be unauth. If not it will need subscriber role user.

Publicly disclosed

2022-10-21

**Details**

Cross-Site Scripting (XSS) vulnerability discovered by Thura Moe Myint (Patchstack Alliance) in WordPress Quiz And Survey Master plugin (versions <= 7.3.10).

**Solution**

Update the WordPress Quiz And Survey Master plugin to the latest available version (at least 7.3.11).

**References**

CVE-2022-40698: WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability - Patchstack

Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress.

 Verified

 Fixed

**4.3**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 2.76.0

PSID 

f9da12615bcc

Classification 

Other Vulnerability Type

OWASP Top 10 

A1: Injection

Required privilege 

Requires subscriber or higher role user authentication.

Publicly disclosed

2022-10-05

**Details**

Race Condition vulnerability leading to voting manipulation discovered by Nguy Minh Tuan (Patchstack Alliance) in the WordPress WP-Polls plugin (versions <= 2.76.0).

**Solution**

Update the WordPress WP-Polls plugin to the latest available version (at least 2.77.0).

**References**

CVE-2022-40130: WordPress WP-Polls plugin <= 2.76.0 - Race Condition vulnerability - Patchstack

Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.

 Verified

 Fixed

**5.3**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.6.2

PSID 

1054f2ff8a05

Classification 

Other Vulnerability Type

OWASP Top 10 

A5: Broken Access Control

Required privilege 

Can be exploited remotely without any authentication.

Publicly disclosed

2022-11-07

**Details**

Broken Access Control vulnerability leading to unauth. changing of Opt-In or Opt-Out tracking settings discovered by Nguyen Anh Tien (Patchstack Alliance) in the WordPress LoginPress plugin (versions <= 1.6.2).

**Solution**

Update the WordPress LoginPress plugin to the latest available version (at least 1.6.3).

**References**

CVE-2022-41839: WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability - Patchstack

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.

CVE-2022-41788: Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 5.6.3.2

PSID 

792f108c7c16

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-20

**Details**

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were discovered by Lana Codes (Patchstack Alliance) in the WordPress Integration for Szamlazz.hu & WooCommerce plugin (versions <= 5.6.3.2).

**Solution**

Update the WordPress Integration for Szamlazz.hu & WooCommerce plugin to the latest available version (at least 5.6.3.3).

**References**

CVE-2022-41685: WordPress Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities - Patchstack

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

 Verified

 Fixed

**6.1**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.4.5

PSID 

18f5b72d7722

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-09-28

**Details**

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability was discovered by Nguy Minh Tuan (Patchstack Alliance) in the WordPress Store Locator plugin (versions <= 1.4.5).

**Solution**

Update the WordPress Store Locator WordPress plugin to the latest available version (at least 1.4.6).

**References**

CVE-2022-41615: WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.

 Verified

 Fixed

**6.5**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 2.6.9

PSID 

cec85aa7ac53

Classification 

Other Vulnerability Type

OWASP Top 10 

A5: Broken Access Control

Required privilege 

Can be exploited remotely without any authentication.

Publicly disclosed

2022-10-28

**Details**

Unauth. Plugin Settings Change vulnerability discovered by Nguyen Anh Tien (Patchstack Alliance) in the WordPress Modula plugin (versions <= 2.6.9).

**Solution**

Update the WordPress Modula Image Gallery plugin to the latest available version (at least 2.6.91).

**References**

CVE-2022-41135: WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

CVE-2022-41634: Media Library Folders

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.

*   Details
*   Reviews
*   Installation
*   Development

A great looking tool to make your WordPress website – accessible ready on all common browsers and platforms (Desktop / Tablets / Mobile).

Check out Our Demo

**Accessibility key features on widget toolkit**

*   Font Size Control
*   Keyboard Navigation
*   Contrast displays: High contrast / Black and White / Black and Yellow.
*   Links Highlight
*   Stop Animations
*   etc…

The plugin will work instantly as you enable it. You can go to the accessibility settings page to define custom settings.

**Extra Features**

*   Multilingual.
*   Auto select language by browser language.
*   Attachments Control Panel: alt and title attributes.

**Support**

If you have any questions or any assistance, feel free to use the support tab above, contact through acc.magixite.com or direct email team@octa-code.com.

We will do our best to solve any issue 🙂

**Suggestions**

If there was something more please let us know, we are always open for inquiry.

**Enjoying the plugin?**

Glad to hear that. Don’t forget to rate it !  
You can control and revise your license settings on https://acc.magixite.com. License is given free.

You may also change the style if you know your way around some css.

—

Happy usage – Enjoy !

The Octa-Code Team

*   We support all platforms.
    

Install from a downloaded zip archive.

1.  Go to your admin menu Plugins -> Add New, and click on “Upload Plugin” near the top.
2.  Browse for the zip file and click on upload.

OR

1.  Extract the downloaded zip archive in your wp-content/plugins directory.

Once uploaded,

Go to your “Installed Plugins” page and enable the plugin.

**May I change the style and positioning of the plugin tool?**

Yes, Just go to acc.magixite.com and edit your license settings, you may also add your own CSS.

**Can I control the language displayed?**

Yes, you can control it on the settings page, or your account at magixite.com

**Can I open the toolbar from keyboard shortcut?**

Yes, just click on the “0” key to toggle the toolbar visibility.

**May I remove the credit of the plugin?**

You should confirm with us first via the publisher site.

**If I have more than website, should I have two different keys?**

It’s not mandatory, but we recommend that you should to keep stuff organized.

Simple small code addition, through this plugin, adds os much control to a site for folks. An essential addon in todays world.

This plugin was created due to many clients inquiries. So we made an official solution 🙂

Read all 2 reviews

“Accessibility” is open source software. The following people have contributed to this plugin.

Contributors

*    ohadsh535

**1.0**

*   First stable Release.

**1.0.1**

Added spanish support for widget.  
Attachments control panel.  
Added locale files.

**1.0.4**

Security fixes.

**1.0.5**

Compatibility verification.

**1.0.6**

Security Optimizations.

CVE-2022-41643: Accessibility

Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.

 Verified

 Fixed

**4.3**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 3.7.1

PSID 

021f82d9c204

Classification 

Other Vulnerability Type

OWASP Top 10 

A3: Sensitive Data Exposure

Required privilege 

Requires subscriber or higher role user authentication.

Publicly disclosed

2022-10-24

**Details**

Auth. Sensitive Data Exposure vulnerability discovered by Lana Codes (Patchstack Alliance) in WordPress Phone Orders for WooCommerce plugin (versions <= 3.7.1).

**Solution**

Update the WordPress Phone Orders for WooCommerce plugin to the latest available version (at least 3.7.2).

**References**

Tag

#wordpress