Taurus Omar

The SEO ALert WordPress plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, for example in multisite setup.

The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings.

The issue is related to a reflected cross-site scripting vulnerability. It occurs because the plugin does not properly escape a URL parameter before outputting it to the page, targeting site administrators.

The issue arises from the plugin's failure to properly sanitize some of its settings. This could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks, even in scenarios where the unfiltered html capability is disallowed, such as in multisite setups.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a `parameter` is not properly sanitised and escaped before being outputted back in the page. This could be exploited against high-privilege users, such as admins, who are logged in.

The issue is related to a SQL injection that can be exploited by an admin via CSRF. This occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement.

The issue is related to the SEO by 10Web WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup.

The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This is due to the plugin not sanitizing and escaping some of its settings.

The issue is related to the Tablesome WordPress plugin, which does not properly escape generated URLs before outputting them in attributes when certain notices are displayed. This leads to Reflected Cross-Site Scripting, allowing a remote attacker to conduct inter-site script attacks.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly escape generated URLs before outputting them back in attributes on an admin page.

The issue is related to stored HTML injection due to a lack of escaping and sanitizing in the payment gateway titles. This allows for potential malicious code injection.

The issue arises from the WP Statistics WordPress plugin not sanitizing the `REQUEST URI` parameter before outputting it back in the rendered page. This leads to Cross-Site Scripting (XSS) in web browsers that do not encode characters.

The issue arises from the Smush WordPress plugin not sanitizing and escaping a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file.

The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape the Project's slug before outputting it in various places, even when the unfiltered html capability is disallowed.

The issue arises from the failure to sanitise and escape the QUERY STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters.

The issue allows any user with access to the plugin, such as Translator and Administrator, to add arbitrary javascript payloads to the source strings, leading to a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel.

The issue allows high privilege users, such as admins, to perform Cross-Site attacks. This is possible because the plugin only performs client-side validation of its "WordPress Target Version" settings and does not sanitize and escape it server-side, even when the unfiltered html capability is disallowed.

The issue allows high privilege users, such as admins, to perform cross-Site Scripting attacks even when the unfiltered html capability is disallowed, due to the lack of sanitization and escaping of the Config Name.

The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the REQUEST URI is not properly sanitised and escaped before being outputted back in an admin page. This can be particularly problematic in browsers that do not encode characters.

The issue is related to a Reflected Cross-Site Scripting (XSS) vulnerability. It occurs because the `updraft interval` parameter is not properly sanitized and escaped before being outputted back in an admin page.