Devowl Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/devowl/ Thu, 23 Feb 2023 14:10:19 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Devowl Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/devowl/ 32 32 CVE-2021-34668 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-34668/ Thu, 23 Feb 2023 14:10:19 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-34668/ The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1.

The post CVE-2021-34668 appeared first on CVE Vulnerability.

]]> The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1.

The post CVE-2021-34668 appeared first on CVE Vulnerability.

]]> CVE-2022-4507 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4507/ Thu, 23 Feb 2023 05:21:23 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4507/ The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.

The post CVE-2022-4507 appeared first on CVE Vulnerability.

]]> The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.

The post CVE-2022-4507 appeared first on CVE Vulnerability.

]]> CVE-2022-0445 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-0445/ Thu, 23 Feb 2023 05:01:52 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-0445/ The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack

The post CVE-2022-0445 appeared first on CVE Vulnerability.

]]> The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack

The post CVE-2022-0445 appeared first on CVE Vulnerability.

]]> CVE-2023-0253 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0253/ Wed, 22 Feb 2023 14:02:12 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0253 The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via folder names in versions up to, and including, 4.18.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with author-level permissions and above to inject arbitrary web scripts in […]

The post CVE-2023-0253 appeared first on CVE Vulnerability.

]]> The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via folder names in versions up to, and including, 4.18.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with author-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The post CVE-2023-0253 appeared first on CVE Vulnerability.

]]> CVE-2023-0285 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0285/ Wed, 22 Feb 2023 14:02:12 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0285 The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0285 appeared first on CVE Vulnerability.

]]> The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0285 appeared first on CVE Vulnerability.

]]>