Show filters
17 Total Results
Displaying 11-17 of 17
Sort by:
Attacker Value
Unknown

CVE-2022-27849

Disclosure Date: April 15, 2022 (last updated February 23, 2025)
Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115
Attacker Value
Unknown

CVE-2022-1165

Disclosure Date: April 04, 2022 (last updated February 23, 2025)
The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. This could also be abused by competitors to cause damage related to visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even the administrator and even more.
Attacker Value
Unknown

CVE-2022-25601

Disclosure Date: February 25, 2022 (last updated February 23, 2025)
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
Attacker Value
Unknown

CVE-2022-25610

Disclosure Date: February 16, 2022 (last updated February 23, 2025)
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
Attacker Value
Unknown

CVE-2021-24409

Disclosure Date: July 12, 2021 (last updated February 23, 2025)
The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
Attacker Value
Unknown

CVE-2021-24408

Disclosure Date: July 12, 2021 (last updated February 23, 2025)
The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
Attacker Value
Unknown

CVE-2016-11001

Disclosure Date: September 20, 2019 (last updated November 27, 2024)
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.