Archive
25 October 2022
Vulnerabilities first published on this day (UTC), newest first.
45 results · Clear filters · Feed
-
Medium 6.5
LBStopAttack < 1.1.3 - Arbitrary Settings Update via CSRF
The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the plugin's protections.
-
Medium 4.8
WP Humans.txt <= 1.0.6 - Admin+ Stored Cross-Site Scripting
The WP Humans.txt WordPress plugin through 1.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
-
Medium 4.8
Contact Bank <= 3.0.30 - Admin+ Stored Cross-Site Scripting
The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…
-
Medium 5.5
Plaintext storage of tokens in pulp_ansible
The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
-
Medium 6.5
AdminPad < 2.2 - Note Update via CSRF
The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin update their notes via a CSRF attack