All CVEs — page 443 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The Testimonials Widget WordPress plugin allows unauthenticated users to submit testimonials that can modify or create arbitrary posts without proper capability checks. This creates a privilege escalation vulnerability where attackers can overwrite any post's title, content, and author.
The flaw allows unauthenticated attackers to perform administrator-only actions by tricking a logged-in administrator into visiting a crafted page, due to improper verification of the WordPress REST API nonce.
A cross-origin message validation flaw in three WordPress file manager plugins allows attackers to inject arbitrary JavaScript into admin sessions by tricking logged-in administrators into visiting malicious pages. This creates a high-severity vector for executing code as administrators.
The flaw allows any authenticated user to overwrite a live form, leading to Stored Cross-Site Scripting (XSS).
The flaw allows any authenticated user to store arbitrary review content, which is later output without escaping, leading to potential Stored Cross-Site Scripting (XSS) attacks.