#Viber messenger update version 7.5.1 code#
#Viber messenger update version 7.5.1 password#

The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide 'Title', 'Description', and Gallery 'Title' fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

#Viber messenger update version 7.5.1 code#

If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited.

#Viber messenger update version 7.5.1 password#

These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution.

A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. The vulnerability is due to insufficient sanitization of the 'data-frmverify' tag for links in the web-based entry inspection page of affected systems. If the Link gets clicked, Javascript code can be executed. The HTML-injection may trick authenticated users to follow the link. Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions, and.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link.

Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin mass update settings, manage subscriptions > add a new subscription, update subscription, delete Subscription.Ĭross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin &attributes, Name > &attributes, &icons, &names, &description, &link, &title.