Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.

**Solution**

 No fix

No patched version is available.

deokhunKim discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress User Location and IP Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-31217: WordPress User Location and IP plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability - Patchstack


Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description







Pega continually works to implement security controls designed to protect client environments. With this focus, Pega was notified of 3 security vulnerabilities that are rated **Medium** on the CVSS scale.  We would like to thank Reuben Seymour, Amber Hamlet and Skyler Knecht for finding these vulnerabilities. 

**Issue** 

**Description** 

**Impact** 

E23 

Cross Site Script (XSS) vulnerability 

Cross-site scripting (XSS) is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. Attackers often initiate an XSS attack by sending a malicious link to a user and enticing the user to click it.    

Clients with internet-facing applications should update or apply the hotfix.  Clients running their own infrastructure should consult their security teams. 

This affects normal authenticated users. 

We are not aware of any of our clients being compromised as a result of this vulnerability. 

The remediation for this issue will be included as part of the product in the 8.7.6, 8.8.4 patch release and the Infinity 23.1.1 release of the Pega Platform.  Hotfixes are being created only for the latest patch releases in standard support (8.7.5 & 8.8.3, and Infinity 23.1.0).  We will not provide hotfixes on prior versions of the platform, nor will we provide steps as part of a local change. 

If you are a **Pega Cloud ®** client or a United States **Pega Cloud for Government (PCFG)** client, details are listed in your Client Advisory (CAD case) on next actions.  

If you are an **on–premises** or **client managed cloud** client, please review the tables below to determine which hotfixes correspond to your Pegasystems installation. Once you have determined the appropriate hotfix IDs, please submit hotfix requests using My Support Portal.  As always, be sure you have appropriate backups in place _before_ applying the hotfixes.  

As always, we recommend our clients review our Security Checklist regularly.  

Please refer to your Client Advisory, \[CAD-\] case that was provided to your security and administrator contacts on Sept 21, 2023, in My Support Portal.  

 CVE Details 

**CVE Details** 

**Issue:** 

**XSS issue with task creation** 

**Issue:** 

**XSS issue with ad-hoc case creation** 

**Issue:** 

**XSS issue with Pin description** 

**Software/Product** 

Pega Platform 

Pega Platform 

Pega Platform 

**Affected Version(s)** 

From 8.1 to Infinity 23.1.0 

From 8.1 to  Infinity 23.1.0 

From 8.1 to  8.8.2 

**CVE ID** 

CVE-2023-32087 

CVE-2023-32088 

CVE-2023-32089 

**CVSS Rating** 

4.6 

4.6 

4.6 

**Description** 

Cross Site Script (XSS) vulnerability 

Cross Site Script (XSS) vulnerability 

Cross Site Script (XSS) vulnerability 

**Hotfix Details** 

Hotfixes have been created only for the latest patch releases in standard support (8.7.5 & 8.8.3, and Infinity 23.1.0).  We will not provide hotfixes on prior versions of the platform, nor will we provide steps as part of a local change.   

As a best practice, you should update your Pega environment to the latest release to take advantage of the latest features, capabilities, security and bug fixes.  See Keeping current with Pega. 

**Version** 

**XSS issue with task creation** 

**XSS issue with ad-hoc case creation** 

**XSS issue with Pin description** 

8.7.5 

HFIX-A666 

HFIX-A666 

HFIX-A667 

8.8.3 

HFIX-A665 

HFIX-A665 

Fixed in release 

Inf 23.1.0 

HFIX-A781 

HFIX-A781 

Fixed in release 

The fixes for these issues are contained in the upcoming patch releases:  The 8.7.6 patch release was made available on Sept 29. 2023.  The 8.8.4 patch release is targeted for the end of Oct. 2023.  The Infinity 23.1.0 release was made available on Sept. 13, 2023. The Infinity 23.1.1 release is targeted for Nov. 2023.  https://support.pega.com/pega-infinity-patch-calendar 

In addition, please review the following article regarding preventing risk of XSS attack when specifying Label controls: https://support.pega.com/support-doc/preventing-risk-xss-attack-when-specifying-label-controls-sdr-a71

CVE-2023-32089: Support Center

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions.

**Solution**

 No fix

No patched version is available.

LEE SE HYOUNG (hackintoanetwork) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress OPcache Dashboard Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45064: WordPress OPcache Dashboard plugin <= 0.3.1 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank thiennv for reporting this vulnerability. Buy a coffee ☕

thiennv discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Download canvasio3D Light Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45062: WordPress canvasio3D Light plugin <= 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank Mika for reporting this vulnerability. Buy a coffee ☕

Mika discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Gumroad Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45059: WordPress Gumroad plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions.

**Solution**

 Fixed

Update the WordPress Hitsteps Web Analytics plugin to the latest available version (at least 5.87).

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Hitsteps Web Analytics Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 5.87.

**Other vulnerabilities in this plugin**

 0 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45057: WordPress Hitsteps Web Analytics plugin <= 5.86 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.

**Solution**

 Fixed

Update the WordPress Open User Map | Everybody can add locations plugin to the latest available version (at least 1.3.27).

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Open User Map | Everybody can add locations Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.3.27.

**Other vulnerabilities in this plugin**

 0 present

 4 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45056: WordPress Open User Map plugin <= 1.3.26 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.

**Solution**

 No fix

No patched version is available. This plugin has been closed as of July 27, 2023 and is not available for download. Reason: Security Issue.

Le Ngoc Anh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Product Category Tree Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 2 present

 0 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45054: WordPress Product Category Tree plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank yuyudhn for reporting this vulnerability. Buy a coffee ☕

yuyudhn discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Image vertical reel scroll slideshow Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45051: WordPress Image vertical reel scroll slideshow plugin <= 9.0 - Cross Site Scripting (XSS) - Patchstack

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Tag

#xss