wordpress wordpress 3.4.0 vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

The flickr-justified-gallery plugin prior to 3.4.0 for WordPress has XSS.

Flickr Justified Gallery Project Flickr Justified Gallery

NA

The WP STAGING WordPress Backup Plugin WordPress plugin prior to 3.4.0, wp-staging-pro WordPress plugin prior to 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when ...

5

CVSSv2

The Find My Blocks WordPress plugin prior to 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.

Find My Blocks Project Find My Blocks

NA

The Official Integration for Billingo WordPress plugin prior to 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform Stored Cross-Site Scripting attacks.

Official Integration For Billingo Project Official Integration For Billingo

NA

The Easy Form Builder WordPress plugin prior to 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in mult...

Whitestudio Easy Form Builder

NA

The Bootstrap Shortcodes WordPress plugin up to and including 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored...

Bootstrap Shortcodes Project Bootstrap Shortcodes

NA

The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with ...

4.3

CVSSv2

In jQuery versions greater than or equal to 1.0.3 and prior to 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted c...

12 Github repositories

4.3

CVSSv2

jQuery prior to 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

97 Github repositories

4.3

CVSSv2

In jQuery versions greater than or equal to 1.2 and prior to 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuer...

12 Github repositories

Get Started

« PREV 1 2 3

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook