Pickplugins Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/pickplugins/ Sun, 26 Feb 2023 06:41:29 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Pickplugins Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/pickplugins/ 32 32 CVE-2020-35936 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-35936/ Sun, 26 Feb 2023 06:41:29 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-35936/ Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.

The post CVE-2020-35936 appeared first on CVE Vulnerability.

]]> Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.

The post CVE-2020-35936 appeared first on CVE Vulnerability.

]]> CVE-2020-35937 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-35937/ Sun, 26 Feb 2023 06:41:29 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-35937/ Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.

The post CVE-2020-35937 appeared first on CVE Vulnerability.

]]> Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.

The post CVE-2020-35937 appeared first on CVE Vulnerability.

]]> CVE-2020-35938 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-35938/ Sun, 26 Feb 2023 06:41:29 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-35938/ PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.

The post CVE-2020-35938 appeared first on CVE Vulnerability.

]]> PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.

The post CVE-2020-35938 appeared first on CVE Vulnerability.

]]> CVE-2020-35939 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-35939/ Sun, 26 Feb 2023 06:41:29 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-35939/ PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.

The post CVE-2020-35939 appeared first on CVE Vulnerability.

]]> PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.

The post CVE-2020-35939 appeared first on CVE Vulnerability.

]]> CVE-2020-13644 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-13644/ Sun, 26 Feb 2023 06:37:01 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-13644/ An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.

The post CVE-2020-13644 appeared first on CVE Vulnerability.

]]> An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.

The post CVE-2020-13644 appeared first on CVE Vulnerability.

]]> CVE-2021-24986 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-24986/ Thu, 23 Feb 2023 14:08:01 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-24986/ The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form

The post CVE-2021-24986 appeared first on CVE Vulnerability.

]]> The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form

The post CVE-2021-24986 appeared first on CVE Vulnerability.

]]> CVE-2021-24488 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-24488/ Thu, 23 Feb 2023 14:07:49 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-24488/ The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues

The post CVE-2021-24488 appeared first on CVE Vulnerability.

]]> The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues

The post CVE-2021-24488 appeared first on CVE Vulnerability.

]]> CVE-2021-24283 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-24283/ Thu, 23 Feb 2023 14:07:44 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-24283/ The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.

The post CVE-2021-24283 appeared first on CVE Vulnerability.

]]> The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.

The post CVE-2021-24283 appeared first on CVE Vulnerability.

]]> CVE-2022-4836 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4836/ Thu, 23 Feb 2023 05:21:50 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4836/ The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4836 appeared first on CVE Vulnerability.

]]> The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4836 appeared first on CVE Vulnerability.

]]> CVE-2022-4693 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4693/ Thu, 23 Feb 2023 05:21:40 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4693/ The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website.

The post CVE-2022-4693 appeared first on CVE Vulnerability.

]]> The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website.

The post CVE-2022-4693 appeared first on CVE Vulnerability.

]]>