CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24986 – Post Grid < 2.1.16 - Reflected Cross-Site Scripting via keyword
https://notcve.org/view.php?id=CVE-2021-24986
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form El plugin Post Grid de WordPress versiones anteriores a 2.1.16, no escapa el parámetro keyword antes de devolverlo en un atributo, conllevando a una vulnerabilidad de tipo Cross-Site Scripting Reflejado en páginas que contienen un Post Grid con un formulario de búsqueda • https://wpscan.com/vulnerability/51e57f25-b8b2-44ca-9162-d7328eac64eb • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24488 – Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24488
The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues La funcionalidad slider import search y el parámetro tab del plugin Post Grid WordPress versiones anteriores a 2.1.8, no son saneados apropiadamente antes de ser devueltos a las páginas, lo que conlleva a problemas de tipo Cross-Site Scripting reflejado WordPress Post Grid plugin version 2.1.1 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/50705 https://wpscan.com/vulnerability/1fc0aace-ba85-4939-9007-d150960add4a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24300 – PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24300
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue La funcionalidad slider import search del plugin PickPlugins Product Slider para WooCommerce WordPress versiones anteriores a 1.13.22 no saneaba apropiadamente el parámetro GET de la palabra clave, conllevando a un problema de tipo Cross-Site Scripting reflejado WordPress Product Slider for WooCommerce plugin version 1.13.21 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/50704 https://wpscan.com/vulnerability/5fbbc7ad-3f1a-48a1-b2eb-e57f153eb837 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24283 – Accordion < 2.2.30 - Authenticated Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24283
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue. El parámetro tab GET de la página de configuración no se sanea ni se escapa al ser devuelto en un atributo HTML, conllevando a un problema de tipo XSS reflejado • https://wpscan.com/vulnerability/6ccd9990-e15f-4800-b499-f7c74b480051 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35939 – Team Showcase <= 1.22.15 - Object Injection
https://notcve.org/view.php?id=CVE-2020-35939
PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts. Unas vulnerabilidades de inyección de objetos PHP en el plugin Team Showcase versiones anteriores a 1.22.16 para WordPress, permiten a atacantes autenticados remotos inyectar objetos PHP arbitrarios debido a una deserialización no segura de los datos suministrados en una carga útil hosteada remotamente en el parámetro source por medio de AJAX. La acción debe ser establecida en la función team_import_xml_layouts. • https://www.wordfence.com/blog/2020/10/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins • CWE-502: Deserialization of Untrusted Data •