Machothemes Archives - CVE Vulnerability

CVE-2020-9003

Sun, 26 Feb 2023 06:43:36 +0000

A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.

The post CVE-2020-9003 appeared first on CVE Vulnerability.

CVE-2020-8549

Sun, 26 Feb 2023 06:43:26 +0000

Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.

The post CVE-2020-8549 appeared first on CVE Vulnerability.

CVE-2020-14962

Sun, 26 Feb 2023 06:37:38 +0000

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.

The post CVE-2020-14962 appeared first on CVE Vulnerability.

CVE-2022-4837

godfreyd94 — Thu, 23 Feb 2023 05:21:50 +0000

The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4837 appeared first on CVE Vulnerability.

CVE-2022-4717

godfreyd94 — Thu, 23 Feb 2023 05:21:42 +0000

The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4717 appeared first on CVE Vulnerability.

CVE-2022-0186

Thu, 23 Feb 2023 05:01:49 +0000

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard

The post CVE-2022-0186 appeared first on CVE Vulnerability.

CVE-2023-0162

godfreyd94 — Wed, 22 Feb 2023 14:02:12 +0000

The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The post CVE-2023-0162 appeared first on CVE Vulnerability.