cpo_companion Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/cpo_companion/ Thu, 23 Feb 2023 05:21:50 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png cpo_companion Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/cpo_companion/ 32 32 CVE-2022-4837 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4837/ Thu, 23 Feb 2023 05:21:50 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4837/ The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4837 appeared first on CVE Vulnerability.

]]> The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4837 appeared first on CVE Vulnerability.

]]> CVE-2023-0162 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0162/ Wed, 22 Feb 2023 14:02:12 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0162 The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that […]

The post CVE-2023-0162 appeared first on CVE Vulnerability.

]]> The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The post CVE-2023-0162 appeared first on CVE Vulnerability.

]]>