portfolio_post Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/portfolio_post/ Thu, 23 Feb 2023 14:07:41 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png portfolio_post Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/portfolio_post/ 32 32 CVE-2021-24129 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-24129/ Thu, 23 Feb 2023 14:07:41 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-24129/ Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.

The post CVE-2021-24129 appeared first on CVE Vulnerability.

]]> Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.

The post CVE-2021-24129 appeared first on CVE Vulnerability.

]]> CVE-2022-4464 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4464/ Thu, 23 Feb 2023 05:21:19 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4464/ Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.

The post CVE-2022-4464 appeared first on CVE Vulnerability.

]]> Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.

The post CVE-2022-4464 appeared first on CVE Vulnerability.

]]> CVE-2022-0200 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-0200/ Thu, 23 Feb 2023 05:01:49 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-0200/ Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting

The post CVE-2022-0200 appeared first on CVE Vulnerability.

]]> Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting

The post CVE-2022-0200 appeared first on CVE Vulnerability.

]]> CVE-2023-0362 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0362/ Wed, 22 Feb 2023 14:02:13 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0362 Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0362 appeared first on CVE Vulnerability.

]]> Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0362 appeared first on CVE Vulnerability.

]]>