Mroccon

A missing capability check in a function allows unauthenticated attackers to perform unauthorized actions. This issue occurs when the plugin is used with Force, enabling the exploitation of incorrectly configured access control security levels.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Insufficient input sanitization and output escaping in the JetFormBuilder plugin for WordPress allow for DOM-Based and Stored Cross-Site Scripting (XSS). This issue enables unauthenticated attackers to inject arbitrary web scripts into pages, which then execute when a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Insufficient input sanitization and output escaping in the `acf-frontend-form-element` allow for Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which then execute when a user accesses the affected page.

The plugin allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the `do shortcode()` function, leading to code injection via improper neutralization of script-related HTML tags.

An issue exists where the software fails to properly neutralize script-related HTML tags and does not validate values before executing the `do shortcode` function. This allows authenticated attackers with Subscriber-level access and above to perform code injection and execute arbitrary shortcodes.

The Addon Elements for Elementor plugin for WordPress contains a flaw that allows unauthenticated attackers to retrieve embedded sensitive user or configuration data. This occurs due to the insertion of sensitive information into sent data.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Cross-Site Request Forgery (CSRF) occurs when an attacker tricks a site administrator into performing an unauthorized action via a forged request. This is caused by missing or incorrect nonce validation on a function, where a nonce is a unique token used to verify that a request was intentionally sent by the user.

The WCFM Marketplace plugin for WordPress contains a missing authorization flaw resulting from an incorrectly configured access control security level. Specifically, a missing capability check in a function allows authenticated attackers with vendor-level access or higher to perform unauthorized actions.

The WCFM Marketplace plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw, which occurs when an application includes untrusted data in a web page without proper validation or escaping. This issue stems from insufficient input sanitization and output escaping, allowing authenticated attackers with vendor-level access or higher to inject arbitrary web scripts into pages. These scripts execute automatically when any user visits the affected page.

The myCred plugin for WordPress allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the `do shortcode()` function, leading to code injection via improper neutralization of script-related HTML tags.

Insufficient input sanitization and output escaping lead to Cross-Site Scripting (XSS), allowing attackers to inject arbitrary web scripts into pages. This includes both Reflected XSS, where scripts are reflected off a web application to the user's browser, and Stored XSS, where scripts are permanently stored on the server and executed when a user accesses the affected page. Unauthenticated attackers can exploit this to execute scripts in the browsers of other users.

Insufficient validation of a user-supplied path allows unauthenticated attackers to perform path traversal, enabling access to files and directories outside of the intended directory.

An unauthenticated attacker can achieve privilege escalation on a WordPress site, allowing them to gain elevated privileges and take over administrative functions.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Cross-Site Request Forgery (CSRF) occurs when an unauthenticated attacker tricks a site administrator into clicking a link, allowing the attacker to perform unauthorized actions via a forged request. This is caused by missing or incorrect nonce validation (a unique token used to prevent request forgery) on a function.

Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected into pages, which then execute when a user accesses the affected page.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.