Archive
23 January 2023
Vulnerabilities first published on this day (UTC), newest first.
56 results · Clear filters · Feed
-
Medium 6.7
WordPress WP TopBar Plugin <= 5.36 is vulnerable to SQL Injection
Auth. SQL Injection (SQLi) vulnerability in WP-TopBar <= 5.36 versions.
-
Medium 6.5
WordPress Youtube shortcode Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)
Auth. Stored Cross-Site Scripting (XSS) vulnerability in Youtube shortcode <= 1.8.5 versions.
-
Medium 6.5
WordPress Oi Yandex.Maps for WordPress Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)
Auth. Stored Cross-Site Scripting (XSS) in Oi Yandex.Maps for WordPress <= 3.2.7 versions.
-
Medium 6.2
A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the a…
-
Medium 4.3
My YouTube Channel <= 3.0.12.1 - Missing Authorization
The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for authenticated attackers, with subscriber…
-
Medium 6.7
A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly n…
-
Medium 5.5
My YouTube Channel <= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…
-
Medium 6.7
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with e…
-
Medium 6.7
A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local …
-
Medium 6.7
A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local …
-
Medium 6.7
A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileg…
-
Medium 5.4
GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks whi…
-
Medium 5.4
Landing Page Builder < 1.4.9.9 - Contributor+ Cross-Site Scripting via Shortcode
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting at…
-
Medium 5.4
Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSS
The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting a…
-
Medium 5.4
Page-list < 5.3 - Contributor+ Stored XSS
The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which cou…
-
Medium 5.4
Structured Content < 1.5.1 - Contributor+ Stored XSS in Shortcode
The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack…
-
Medium 5.4
HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via Shortcode
The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 5.4
10WebMapBuilder < 1.0.72 - Contributor+ Stored XSS via Shortcode
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks …
-
Medium 5.4
Search & Filter < 1.2.16 - Contributor+ Stored XSS
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks …
-
Medium 5.4
ShiftNav – Responsive Mobile Menu < 1.7.2 - Contributor+ Stored XSS in Shortcode
The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which co…
-
Medium 5.4
WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via Shortcode
The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 5.4
Print-O-Matic < 2.1.8 - Contributor+ Stored XSS via Shortcode
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks whi…
-
Medium 6.5
Optimize images ALT Text (alt tag) & names for SEO using AI < 2.0.8 - Settings Update via CSRF
The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
-
Medium 5.4
Content Control < 1.1.10 - Contributor+ Stored XSS
The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attac…
-
Medium 5.4
Sitemap < 4.4 - Contributor+ Stored XSS
The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could…
-
Medium 5.4
Genesis Columns Advanced < 2.0.4 - Contributor+ Stored XSS via Shortcode
The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scriptin…
-
Medium 5.4
Word Balloon < 4.19.3 - Contributor+ Stored XSS via Shortcode
The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks whi…
-
Medium 4.8
EU Cookie Law <= 3.1.6 - Admin+ Stored XSS
The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is d…
-
Medium 5.4
Top 10 < 3.2.3 - Contributor+ Stored XSS
The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be…
-
Medium 5.4
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box < 6.4.0 - Contributor+ Stored XSS
The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks …
-
Medium 5.4
Mongoose Page Plugin < 1.9.0 - Contributor+ Stored XSS via Shortcode
The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 5.4
WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode
The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 5.4
Collapse-O-Matic < 1.8.3 - Contributor+ Stored XSS
The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks …
-
Medium 6.5
BruteBank - WP Security & Firewall < 1.9 - Settings Update via CSRF
The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
-
Medium 5.4
Easy Bootstrap Shortcode <= 4.5.4 - Contributor+ Stored XSS
The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting…
-
Medium 5.4
GS Logo Slider < 3.3.8 - Contributor+ Stored XSS in Shortcode
The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks wh…
-
Medium 5.4
Rate my Post – WP Rating System < 3.3.9 - Contributor+ Stored XSS via Shortcode
The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
-
Medium 6.1
Pardakht Delkhah < 2.9.3 - Unauthenticated Stored XSS
The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from t…
-
Medium 5.3
All In One WP Security & Firewall < 5.1.3 - Configuration Leak
The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.
-
Medium 5.4
WP Popups < 2.1.4.8 - Contributor+ Stored XSS
The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which…