Shapedplugin Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/shapedplugin/ Thu, 23 Feb 2023 14:07:55 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Shapedplugin Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/shapedplugin/ 32 32 CVE-2021-24738 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-24738/ Thu, 23 Feb 2023 14:07:55 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-24738/ The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the “Logo Margin” carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

The post CVE-2021-24738 appeared first on CVE Vulnerability.

]]> The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the “Logo Margin” carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks

The post CVE-2021-24738 appeared first on CVE Vulnerability.

]]> CVE-2021-24739 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-24739/ Thu, 23 Feb 2023 14:07:55 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-24739/ The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

The post CVE-2021-24739 appeared first on CVE Vulnerability.

]]> The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

The post CVE-2021-24739 appeared first on CVE Vulnerability.

]]> CVE-2022-4648 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4648/ Thu, 23 Feb 2023 05:21:36 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4648/ The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4648 appeared first on CVE Vulnerability.

]]> The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4648 appeared first on CVE Vulnerability.

]]> CVE-2022-4629 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4629/ Thu, 23 Feb 2023 05:21:34 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4629/ The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4629 appeared first on CVE Vulnerability.

]]> The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

The post CVE-2022-4629 appeared first on CVE Vulnerability.

]]> CVE-2022-2382 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-2382/ Thu, 23 Feb 2023 05:03:08 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-2382/ The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.

The post CVE-2022-2382 appeared first on CVE Vulnerability.

]]> The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.

The post CVE-2022-2382 appeared first on CVE Vulnerability.

]]> CVE-2023-25065 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-25065/ Wed, 22 Feb 2023 14:02:30 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-25065 Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin

The post CVE-2023-25065 appeared first on CVE Vulnerability.

]]> Cross-Site Request Forgery (CSRF) vulnerability in ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress plugin <= 2.1.14 versions.

The post CVE-2023-25065 appeared first on CVE Vulnerability.

]]> CVE-2023-0360 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0360/ Wed, 22 Feb 2023 14:02:13 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0360 The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0360 appeared first on CVE Vulnerability.

]]> The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0360 appeared first on CVE Vulnerability.

]]> CVE-2023-0071 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0071/ Wed, 22 Feb 2023 14:02:11 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0071 The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0071 appeared first on CVE Vulnerability.

]]> The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0071 appeared first on CVE Vulnerability.

]]> CVE-2023-0097 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0097/ Wed, 22 Feb 2023 14:02:11 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0097 The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0097 appeared first on CVE Vulnerability.

]]> The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The post CVE-2023-0097 appeared first on CVE Vulnerability.

]]>