Vulnerabilidades

Se encontró una vulnerabilidad en el complemento Most Popular Posts Widget hasta la versión 0.8 en WordPress. Ha sido clasificada como crítica. La función add_views/show_views del archivo functions.php es afectada por la vulnerabilidad. La manipulación conduce a la inyección de SQL. Es posible lanzar el ataque de…

El complemento Widget Responsive de Youtube para WordPress es vulnerable a Cross-Site Scripting almacenado a través del código abreviado de 'youtube' en versiones hasta la 1.6.1 inclusive debido a una sanitización de entrada insuficiente y a un escape de salida en los atributos proporcionados por el usuario. Esto hace…

El complemento WS Facebook Like Box Widget para WordPress plugin para WordPress es vulnerable a Cross-Site Scripting a través del código corto 'ws-facebook-likebox' en versiones hasta la 5.0 incluida debido a una insuficiente sanitización y a un escape de salida en los atributos proporcionados por el usuario. Esto…

El complemento Awesome Weather Widget para WordPress es vulnerable a Cross-Site Scripting (XSS) almacenado a través del código corto 'awesome-weather' en versiones hasta la 3.0.2 inclusive debido a una sanittización de entrada insuficiente y a un escape de salida en los atributos proporcionados por el usuario. Esto…

El complemento JQuery Accordion Menu Widget de WordPress para WordPress es vulnerable a Cross-Site Scripting almacenado a través del código corto 'dcwp-jquery-accordion' en versiones hasta 3.1.2 incluida, debido a la insuficiente sanitización de entrada y salida que se escapa en los atributos proporcionados por el…

Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada No Autenticada en el complemento en WP-EXPERTS.IN TEAM WP Categories Widge versiones <= 2.2

User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0.

There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0.

There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widget v1.0.

There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Callback Widget v1.0.

There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Widget v1.0.

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in bkmacdaddy designs Pinterest RSS Widget plugin <= 2.3.1 versions.

Vulnerabilidad de Cross-Site Scripting (XSS) reflejado sin necesidad de autenticación en el plugin CodeBard CodeBard's Patron Button and Widgets for Patreon en versiones anteriores, e incluyendo, la 2.1.8.

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers…

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions,…

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PluginForage WooCommerce Product Categories Selection Widget plugin <= 2.0 versions.

Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.

Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Chirkov Advanced Text Widget plugin <= 2.1.2 versions.

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rating-Widget Rating-Widget: Star Review System plugin <= 3.1.9 versions.

Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.

Cross-Site Request Forgery (CSRF) vulnerability in Csaba Kissi About Me 3000 widget plugin <= 2.2.6 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeff Starr Dashboard Widgets Suite plugin <= 3.2.1 versions.