Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

 Verified

 Fixed

**6.1**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.4.5

PSID 

18f5b72d7722

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-09-28

**Details**

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability was discovered by Nguy Minh Tuan (Patchstack Alliance) in the WordPress Store Locator plugin (versions <= 1.4.5).

**Solution**

Update the WordPress Store Locator WordPress plugin to the latest available version (at least 1.4.6).

**References**

CVE-2022-41615: WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.

 Verified

 Fixed

**6.5**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 2.6.9

PSID 

cec85aa7ac53

Classification 

Other Vulnerability Type

OWASP Top 10 

A5: Broken Access Control

Required privilege 

Can be exploited remotely without any authentication.

Publicly disclosed

2022-10-28

**Details**

Unauth. Plugin Settings Change vulnerability discovered by Nguyen Anh Tien (Patchstack Alliance) in the WordPress Modula plugin (versions <= 2.6.9).

**Solution**

Update the WordPress Modula Image Gallery plugin to the latest available version (at least 2.6.91).

**References**

CVE-2022-41135: WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability - Patchstack

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.

CVE-2022-41788: Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

CVE-2022-41634: Media Library Folders

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.

*   Details
*   Reviews
*   Installation
*   Development

A great looking tool to make your WordPress website – accessible ready on all common browsers and platforms (Desktop / Tablets / Mobile).

Check out Our Demo

**Accessibility key features on widget toolkit**

*   Font Size Control
*   Keyboard Navigation
*   Contrast displays: High contrast / Black and White / Black and Yellow.
*   Links Highlight
*   Stop Animations
*   etc…

The plugin will work instantly as you enable it. You can go to the accessibility settings page to define custom settings.

**Extra Features**

*   Multilingual.
*   Auto select language by browser language.
*   Attachments Control Panel: alt and title attributes.

**Support**

If you have any questions or any assistance, feel free to use the support tab above, contact through acc.magixite.com or direct email team@octa-code.com.

We will do our best to solve any issue 🙂

**Suggestions**

If there was something more please let us know, we are always open for inquiry.

**Enjoying the plugin?**

Glad to hear that. Don’t forget to rate it !  
You can control and revise your license settings on https://acc.magixite.com. License is given free.

You may also change the style if you know your way around some css.

—

Happy usage – Enjoy !

The Octa-Code Team

*   We support all platforms.
    

Install from a downloaded zip archive.

1.  Go to your admin menu Plugins -> Add New, and click on “Upload Plugin” near the top.
2.  Browse for the zip file and click on upload.

OR

1.  Extract the downloaded zip archive in your wp-content/plugins directory.

Once uploaded,

Go to your “Installed Plugins” page and enable the plugin.

**May I change the style and positioning of the plugin tool?**

Yes, Just go to acc.magixite.com and edit your license settings, you may also add your own CSS.

**Can I control the language displayed?**

Yes, you can control it on the settings page, or your account at magixite.com

**Can I open the toolbar from keyboard shortcut?**

Yes, just click on the “0” key to toggle the toolbar visibility.

**May I remove the credit of the plugin?**

You should confirm with us first via the publisher site.

**If I have more than website, should I have two different keys?**

It’s not mandatory, but we recommend that you should to keep stuff organized.

Simple small code addition, through this plugin, adds os much control to a site for folks. An essential addon in todays world.

This plugin was created due to many clients inquiries. So we made an official solution 🙂

Read all 2 reviews

“Accessibility” is open source software. The following people have contributed to this plugin.

Contributors

*    ohadsh535

**1.0**

*   First stable Release.

**1.0.1**

Added spanish support for widget.  
Attachments control panel.  
Added locale files.

**1.0.4**

Security fixes.

**1.0.5**

Compatibility verification.

**1.0.6**

Security Optimizations.

CVE-2022-41643: Accessibility

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 5.6.3.2

PSID 

792f108c7c16

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-20

**Details**

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were discovered by Lana Codes (Patchstack Alliance) in the WordPress Integration for Szamlazz.hu & WooCommerce plugin (versions <= 5.6.3.2).

**Solution**

Update the WordPress Integration for Szamlazz.hu & WooCommerce plugin to the latest available version (at least 5.6.3.3).

**References**

CVE-2022-41685: WordPress Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities - Patchstack

Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.

 Verified

 Fixed

**4.3**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 3.7.1

PSID 

021f82d9c204

Classification 

Other Vulnerability Type

OWASP Top 10 

A3: Sensitive Data Exposure

Required privilege 

Requires subscriber or higher role user authentication.

Publicly disclosed

2022-10-24

**Details**

Auth. Sensitive Data Exposure vulnerability discovered by Lana Codes (Patchstack Alliance) in WordPress Phone Orders for WooCommerce plugin (versions <= 3.7.1).

**Solution**

Update the WordPress Phone Orders for WooCommerce plugin to the latest available version (at least 3.7.2).

**References**

CVE-2022-41655: WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability - Patchstack

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 5.6.1

PSID 

a637b68a17fd

Classification 

Other Vulnerability Type

OWASP Top 10 

A5: Broken Access Control

Required privilege 

Requires subscriber or higher role user authentication.

Publicly disclosed

2022-10-31

**Details**

Broken Access Control vulnerability leading to Plugin Settings Change discovered by Lana Codes (Patchstack Alliance) in WordPress miniOrange's Google Authenticator plugin (versions <= 5.6.1).

**Solution**

Update the WordPress miniOrange's Google Authenticator plugin to the latest available version (at least 5.6.2).

**References**

CVE-2022-42461: WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability - Patchstack

Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.

 Verified

 Fixed

**4.3**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.3.69

PSID 

f42d72f1e6b9

Classification 

Other Vulnerability Type

OWASP Top 10 

A5: Broken Access Control

Required privilege 

Requires subscriber or higher role user authentication.

Publicly disclosed

2022-10-30

**Details**

Missing Authorization vulnerability leading to Feedback Submission discovered by Lana Codes (Patchstack Alliance) in the WordPress Appointment Booking Calendar plugin (versions <= 1.3.69).

**Solution**

Update the WordPress Appointment Booking Calendar plugin to the latest available version (at least 1.3.70).

**References**

CVE-2022-43482: WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress.

 Verified

 Fixed

**4.8**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.7.9

PSID 

de287f0e19f1

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires high role user authentication like admin.

Publicly disclosed

2022-10-30

**Details**

Auth. Stored Cross-Site Scripting (XSS) vulnerability discovered by Muhammad Daffa (Patchstack Alliance) in WordPress Custom Product Tabs for WooCommerce plugin (versions <= 1.7.9).

**Solution**

Update the WordPress Custom Product Tabs for WooCommerce plugin to the latest available version (at least 1.8.0).

**References**

Tag

#wordpress