Filtered by vendor Vektor-inc
Subscribe
Total
11 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-37956 | 1 Vektor-inc | 1 Vk All In One Expansion Unit | 2024-08-30 | N/A | 5.4 MEDIUM |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vektor,Inc. VK All in One Expansion Unit allows Stored XSS.This issue affects VK All in One Expansion Unit: from n/a through 9.99.1.0. | |||||
| CVE-2024-0623 | 1 Vektor-inc | 1 Vk Block Patterns | 2024-02-05 | N/A | 4.3 MEDIUM |
| The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for unauthenticated attackers to clear the patterns cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |||||
| CVE-2023-5706 | 1 Vektor-inc | 1 Vk Blocks | 2024-02-05 | N/A | 5.4 MEDIUM |
| The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, and including, 1.63.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-27923 | 1 Vektor-inc | 1 Vk Blocks | 2024-02-04 | N/A | 5.4 MEDIUM |
| Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script. | |||||
| CVE-2023-27925 | 1 Vektor-inc | 1 Vk Blocks | 2024-02-04 | N/A | 5.4 MEDIUM |
| Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script. | |||||
| CVE-2023-0937 | 1 Vektor-inc | 1 Vk All In One Expansion Unit | 2024-02-04 | N/A | 6.1 MEDIUM |
| The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers | |||||
| CVE-2023-28367 | 1 Vektor-inc | 1 Vk All In One Expansion Unit | 2024-02-04 | N/A | 5.4 MEDIUM |
| Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script. | |||||
| CVE-2023-0583 | 1 Vektor-inc | 1 Vk Blocks | 2024-02-04 | N/A | 4.3 MEDIUM |
| The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons. | |||||
| CVE-2023-27926 | 1 Vektor-inc | 1 Vk All In One Expansion Unit | 2024-02-04 | N/A | 5.4 MEDIUM |
| Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script. | |||||
| CVE-2023-0584 | 1 Vektor-inc | 1 Vk Blocks | 2024-02-04 | N/A | 4.3 MEDIUM |
| The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_font_awesome_version' option to an arbitrary value. | |||||
| CVE-2023-0230 | 1 Vektor-inc | 1 Vk All In One Expansion Unit | 2024-02-04 | N/A | 5.4 MEDIUM |
| The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | |||||