Show filters
3 Total Results
Displaying 1-3 of 3
Sort by:
Attacker Value
Unknown
CVE-2021-24672
Disclosure Date: October 18, 2021 (last updated February 23, 2025)
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
0
Attacker Value
Unknown
CVE-2021-24675
Disclosure Date: October 18, 2021 (last updated February 23, 2025)
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
0
Attacker Value
Unknown
CVE-2011-3860
Disclosure Date: September 28, 2011 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
0
