WordPress 6.7 through 7.1.3 built the Categories block's dropdown markup by concatenating the block's label attribute into the sprintf() format string. A Contributor could store a Categories block whose label contains printf conversion specifiers (such as %1$s or %2$s), which KSES keeps as plain text; when the block is rendered, sprintf() expands... Weiterlesen: Authenticated (Contributor+) Stored Cross-Site Scripting via WordPres…
Intelligence View
⚡ tsecurity.de Intelligence
Authenticated (Contributor+) Stored Cross-Site Scripting via WordPress Categories Block Label
WordPress 6.7 through 7.1.3 built the Categories block's dropdown markup by concatenating the block's label attribute into the sprintf() format string. A…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
14 Quellen
Stored Cross-Site Scripting in YITH WooCommerce Wishlist Move-to-Wishlist Popup
13 weitere Quellen
VVulnerability definition fe…vor 5 Std.Stored Cross-Site Scripting in WordPress Personal Data Request Screens VVulnerability definition fe…vor 5 Std.Stored Cross-Site Scripting in ElementsKit Simple Tab Widget VVulnerability definition fe…vor 5 Std.Reflected Cross-Site Scripting in UpdraftPlus Restore Page VVulnerability definition fe…vor 5 Std.Stored Cross-Site Scripting in Ultimate Addons for Elementor Navigation Menu Icons VVulnerability definition fe…vor 5 Std.Authenticated (Contributor+) Stored Cross-Site Scripting via WordPress Block Delimiter Whitespace VVulnerability definition fe…vor 5 Std.Stored Cross-Site Scripting in WordPress Interactivity API Object Bindings
+7
13 Quellen
CVE-2026-82632 | GitLab up to 19.2.7/19.3.4/19.4.1 Import improper authorization (WID-SEC-2026-3858)
12 weitere Quellen
VVulDB Updatesvor 1 Std.CVE-2026-9268 | GitLab up to 19.2.7/19.3.4/19.4.1 CI/CD Deployment Rollback Settings privileges management (WID-SEC-2026-3858) VVulDB Updatesvor 2 Std.CVE-2026-105458 | GitLab up to 19.2.7/19.3.4/19.4.1 Duo Agent Platform permission (WID-SEC-2026-3858) VVulDB Updatesvor 2 Std.CVE-2026-104661 | GitLab up to 19.2.7/19.3.4/19.4.1 Compliance Pipeline permission (WID-SEC-2026-3858) VVulDB Updatesvor 2 Std.CVE-2026-14552 | GitLab up to 19.2.7/19.3.4/19.4.1 Epic improper authorization (WID-SEC-2026-3858) VVulDB Updatesvor 2 Std.CVE-2026-14814 | GitLab up to 19.2.7/19.3.4/19.4.1 CI/CD Pipeline input validation (WID-SEC-2026-3858) VVulDB Updatesvor 2 Std.CVE-2026-16275 | GitLab up to 19.2.7/19.3.4/19.4.1 improper authorization (WID-SEC-2026-3858)
+6
8 Quellen
CVE-2026-115943 | Spreadsheet::XLSX up to 0.18 ExcelFmt os command injection (EUVD-2026-113403)
7 weitere Quellen
VVulDB Updatesvor 1 Std.CVE-2026-51832 | IDrive Backup up to 7.0.1.1 id_service.exe os command injection (EUVD-2026-113367) VVulDB Updatesvor 1 Std.CVE-2026-51831 | IDrive Backup for Windows up to 7.0.1.1 id_service.exe os command injection (EUVD-2026-113368) VVulDB Updatesvor 30 Min.CVE-2022-48124 | TOTOLINK A7100RU 7.4cu.2313_B20191024 Setting setOpenVpnCertGenerationCfg FileName command injection (EUVD-2022-50836) VVulDB Updatesvor 30 Min.CVE-2022-48126 | TOTOLINK A7100RU 7.4cu.2313_B20191024 Setting setOpenVpnCertGenerationCfg username command injection (EUVD-2022-50838) VVulDB Updatesvor 30 Min.CVE-2022-48125 | TOTOLINK A7100RU 7.4cu.2313_B20191024 Setting setOpenVpnCertGenerationCfg password command injection (EUVD-2022-50837) VVulDB Updatesvor 3 Std.CVE-2024-45257 | BYOB 2.0 Payload Build Page core/generators.py build command injection
+1
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4307793/sichere-programmierung/authenticated-contributor-stored-cross-site-scripting-via-wordpress-categories-block-label/