Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Scroll post excerpt plugin <= 8.0 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Scroll post excerpt Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45764: WordPress Scroll post excerpt plugin <= 8.0 - Cross Site Scripting (XSS) - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions.

**Solution**

 No fix

No patched version is available.

Ivy (TOOR, LISA) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress WP Report Post Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**Other vulnerabilities in this plugin**

 3 present

 0 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45769: WordPress WP Report Post plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Stephanie Leary Next Page plugin <= 1.5.2 versions.

**Solution**

 No fix

No patched version is available.

Found this useful? Thank Rio Darmawan for reporting this vulnerability. Buy a coffee ☕

Rio Darmawan discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Next Page Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45768: WordPress Next Page plugin <= 1.5.2 - Cross Site Scripting (XSS) - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Joovii Sendle Shipping Plugin plugin <= 5.13 versions.

**Solution**

 No fix

No patched version is available.

LEE SE HYOUNG (hackintoanetwork) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Sendle Shipping Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45761: WordPress Sendle Shipping plugin <= 5.14 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fastwpspeed Fast WP Speed plugin <= 1.0.0 versions.

**Solution**

 No fix

No patched version is available.

LEE SE HYOUNG (hackintoanetwork) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Fast WP Speed Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-45770: WordPress Fast WP Speed plugin <= 1.0.0 - Reflected Cross-Site Scripting vulnerability - Patchstack

The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2023-5110: category-dropdown.php in bsk-pdf-manager/trunk/classes/shortcodes/category – WordPress Plugin Repository

Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

* Products
 * Openwall GNU/\*/Linux   _server OS_
 * Linux Kernel Runtime Guard
 * John the Ripper   _password cracker_
 * Free & Open Source for any platform
 * in the cloud
 * Pro for Linux
 * Pro for macOS
 * Wordlists   _for password cracking_
 * passwdqc   _policy enforcement_
 * Free & Open Source for Unix
 * Pro for Windows (Active Directory)
 * yescrypt   _KDF & password hashing_
 * yespower   _Proof-of-Work (PoW)_
 * crypt\_blowfish   _password hashing_
 * phpass   _ditto in PHP_
 * tcb   _better password shadowing_
 * Pluggable Authentication Modules
 * scanlogd   _port scan detector_
 * popa3d   _tiny POP3 daemon_
 * blists   _web interface to mailing lists_
 * msulogin   _single user mode login_
 * php\_mt\_seed   _mt\_rand() cracker_
* Services
* Publications
 * Articles
 * Presentations
* Resources
 * Mailing lists
 * Community wiki
 * Source code repositories (GitHub)
 * Source code repositories (CVSweb)
 * File archive & mirrors
 * How to verify digital signatures
 * OVE IDs
* What's new

\[<prev\] \[next>\] \[day\] \[month\] \[year\] \[list\]

Date: Wed, 25 Oct 2023 15:27:24 +0200
From: Daniel Beck <ml@...kweb.net>
To: oss-security@...ts.openwall.com
Subject: Multiple vulnerabilities in Jenkins plugins

Jenkins is an open source automation server which enables developers around
the world to reliably build, test, and deploy their software.

The following releases contain fixes for security vulnerabilities:

\* CloudBees CD Plugin 1.1.33
\* GitHub Plugin 1.37.3.1
\* lambdatest-automation Plugin 1.20.10 and 1.21.0
\* Warnings Plugin 10.5.1

Additionally, we announce unresolved security issues in the following
plugins:

\* Edgewall Trac Plugin
\* Gogs Plugin
\* MSTeams Webhook Trigger Plugin
\* Multibranch Scan Webhook Trigger Plugin
\* Zanata Plugin

Summaries of the vulnerabilities are below. More details, severity, and
attribution can be found here:
https://www.jenkins.io/security/advisory/2023-10-25/

We provide advance notification for security updates on this mailing list:
https://groups.google.com/d/forum/jenkinsci-advisories

If you discover security vulnerabilities in Jenkins, please report them as
described here:
https://www.jenkins.io/security/#reporting-vulnerabilities

---

SECURITY-3246 / CVE-2023-46650
GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on
the build page when showing changes.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Item/Configure permission.


SECURITY-3265 / CVE-2023-46651
Warnings Plugin 10.5.0 and earlier does not set the appropriate context for
credentials lookup, allowing the use of system-scoped credentials otherwise
reserved for the global configuration.

This allows attackers with Item/Configure permission to access and capture
credentials they are not entitled to.


SECURITY-3222 / CVE-2023-46652
lambdatest-automation Plugin 1.20.9 and earlier does not perform a
permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials
IDs of LAMBDATEST credentials stored in Jenkins. Those can be used as part
of an attack to capture the credentials using another vulnerability.


SECURITY-3202 / CVE-2023-46653
lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST
Credentials access token at the INFO level.

This can result in accidental exposure of the token through the default
system log.


SECURITY-3237 / CVE-2023-46654
In CloudBees CD Plugin, artifacts that were previously copied from an agent
to the controller are deleted after publishing by the 'CloudBees CD -
Publish Artifact' post-build step.

CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations
outside of the expected directory during this cleanup process.

This allows attackers able to configure jobs to delete arbitrary files on
the Jenkins controller file system.


SECURITY-3238 / CVE-2023-46655
CloudBees CD Plugin temporarily copies files from an agent workspace to the
controller in preparation for publishing them in the 'CloudBees CD -
Publish Artifact' post-build step.

CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations
outside of the temporary directory on the controller when collecting the
list of files to publish.

This allows attackers able to configure jobs to publish arbitrary files
from the Jenkins controller file system to the previously configured
CloudBees CD server.


SECURITY-2875 / CVE-2023-46656
Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier does not use a
constant-time comparison when checking whether the provided and expected
webhook token are equal.

This could potentially allow attackers to use statistical methods to obtain
a valid webhook token.

As of publication of this advisory, there is no fix.


SECURITY-2896 / CVE-2023-46657
Gogs Plugin 1.0.15 and earlier does not use a constant-time comparison when
checking whether the provided and expected webhook token are equal.

This could potentially allow attackers to use statistical methods to obtain
a valid webhook token.

As of publication of this advisory, there is no fix.


SECURITY-2876 / CVE-2023-46658
MSTeams Webhook Trigger Plugin 0.1.1 and earlier does not use a
constant-time comparison when checking whether the provided and expected
webhook token are equal.

This could potentially allow attackers to use statistical methods to obtain
a valid webhook token.

As of publication of this advisory, there is no fix.


SECURITY-3247 / CVE-2023-46659
Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL
on the build page.

This results in a stored cross-site scripting (XSS) vulnerability
exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.


SECURITY-2879 / CVE-2023-46660
Zanata Plugin 0.6 and earlier does not use a constant-time comparison when
checking whether the provided and expected webhook token hashes are equal.

This could potentially allow attackers to use statistical methods to obtain
a valid webhook token.

As of publication of this advisory, there is no fix.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2023-46650: security - Multiple vulnerabilities in Jenkins plugins

The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

1<?php2   /\*3   Plugin Name: WP Font Awesome4   Plugin URI: https://wordpress.org/plugins/wp-font-awesome/5   Description: This plugin allows the easily embed Font Awesome to your site.6   Version: 1.7.97   Author: Zayed Baloch8   Author URI: https://www.zayedbaloch.com/9   License: GPL210   \*/1112defined('ABSPATH') or die("No script kiddies please!");13define( 'ZB\_FAWE\_VERSION',   '1.7.9' );14define( 'ZB\_FAWE\_URL', plugins\_url( '', \_\_FILE\_\_ ) );15define( 'ZB\_FAWE\_TEXTDOMAIN',  'zb\_font\_awesome' );1617function zb\_wp\_font\_awesome() {18  load\_plugin\_textdomain( ZB\_FAWE\_TEXTDOMAIN );19}20add\_action( 'init', 'zb\_wp\_font\_awesome' );21222324function wp\_font\_awesome\_style() {2526  wp\_register\_style('fontawesome-css-6', ZB\_FAWE\_URL . '/font-awesome/css/fontawesome-all.min.css', array(), ZB\_FAWE\_VERSION);27  wp\_enqueue\_style('fontawesome-css-6');2829  wp\_register\_style('fontawesome-css-4', ZB\_FAWE\_URL . '/font-awesome/css/v4-shims.min.css', array(), ZB\_FAWE\_VERSION);30  wp\_enqueue\_style('fontawesome-css-4');31  32}33add\_action('wp\_enqueue\_scripts', 'wp\_font\_awesome\_style');3435function wp\_font\_awesome\_style\_admin() {36    // TODO: Only Load on Edit Page37    wp\_enqueue\_style('wp-font-awesome-script-admin', ZB\_FAWE\_URL.'/style.css');38}3940add\_action('admin\_enqueue\_scripts', 'wp\_font\_awesome\_style\_admin');4142/\*function wp\_font\_awesome\_admin\_script() {43  wp\_enqueue\_script( 'wp-font-awesome-script', ZB\_FAWE\_URL . '/script.js', array( 'jquery' ), ZB\_FAWE\_VERSION, true );44}45add\_action( 'admin\_enqueue\_scripts', 'wp\_font\_awesome\_admin\_script' );\*/4647function wp\_fa\_shortcode( $atts ) {48  extract( shortcode\_atts( array( 'icon' \=> 'home', 'size' \=> '', 'color' \=> '', 'sup' \=> ''), $atts ) );49  if ( $size ) { $size \= esc\_attr(' fa-'.$size); } else{ $size \= ''; }50  if ( $color ) { $color \= ' style="color: '.esc\_attr($color) ; } else{ $color \= esc\_attr(''); }5152  if ( strtolower($sup) \=== 'yes' ) {53    return '';54  } else{55    return '';56  }57}5859function wp\_fa5s\_shortcode( $atts ) {60  extract( shortcode\_atts( array( 'icon' \=> 'home', 'size' \=> '', 'color' \=> '', 'sup' \=> '' ), $atts ) );61  if ( $size ) { $size \= esc\_attr(' fa-'.$size); }62  else{ $size \= ''; }6364  if ( $color ) { $color \= ' style="color: '.esc\_attr($color) ; }65  else{ $color \= ''; }6667  if ( strtolower($sup) \=== 'yes' ) {68    return '';69  } else{70    return '';71  }72}7374function wp\_fa5r\_shortcode( $atts ) {75  extract( shortcode\_atts( array( 'icon' \=> 'home', 'size' \=> '', 'color' \=> '', 'sup' \=> '' ), $atts ) );76  if ( $size ) { $size \= esc\_attr(' fa-'.$size); }77  else{ $size \= ''; }7879  if ( $color ) { $color \= ' style="color: '.esc\_attr($color) ; }80  else{ $color \= ''; }8182  if ( strtolower($sup) \=== 'yes' ) {83    return '';84  } else{85    return '';86  }8788}8990function wp\_fa5b\_shortcode( $atts ) {91  extract( shortcode\_atts( array( 'icon' \=> 'home', 'size' \=> '', 'color' \=> '', 'sup' \=> '' ), $atts ) );92  if ( $size ) { $size \= esc\_attr(' fa-'.$size); }93  else{ $size \= ''; }9495  if ( $color ) { $color \= ' style="color: '.esc\_attr($color) ; }96  else{ $color \= ''; }9798  if ( strtolower($sup) \=== 'yes' ) {99    return '';100  } else{101    return '';102  }103104}105106add\_shortcode( 'wpfa', 'wp\_fa\_shortcode' );107add\_shortcode( 'wpfa5s', 'wp\_fa5s\_shortcode' );108add\_shortcode( 'wpfa5r', 'wp\_fa5r\_shortcode' );109add\_shortcode( 'wpfa5b', 'wp\_fa5b\_shortcode' );110111add\_filter('wp\_nav\_menu\_items', 'do\_shortcode');112add\_filter('widget\_text', 'do\_shortcode');113add\_filter('widget\_title', 'do\_shortcode');114115function wpfa\_add\_shortcode\_to\_title( $title ){116  return do\_shortcode($title);117}118add\_filter( 'the\_title', 'wpfa\_add\_shortcode\_to\_title' );119120121function wpfontawesome\_register\_setting\_page() {122  add\_options\_page('WP Font Awesome', 'WP Font Awesome', 'manage\_options', 'wpFontAwesome', 'wpfontawesome\_setting\_page');123}124add\_action('admin\_menu', 'wpfontawesome\_register\_setting\_page');125126function wpfontawesome\_setting\_page(){127?>128129  <h2>WP Font Awesome &nbsp;&nbsp;Version: 1.7</h2>130  This plugin allows you to easily embed Font Awesome icon to your site with simple shortcodes.131132  <h2>Shortcodes</h2>133Introduced three new shortcode for Font Awesome support.134135Font Awesome 5136<code>\[wpfa5s icon="home" size="3x" color"#336699"\]</code> for Solid style.137<code>\[wpfa5r icon="user" color="red"\]</code> for Regular style. support only in few icon.138<code>\[wpfa5b icon="wordpress" size="5x" color="#3B5998"\]</code> for Brands.139 140Font Awesome 4.7141<code>\[wpfa icon="gear" color="green"\]</code>.142143 144<h2>Size</h2>145<code>xs</code>, <code>sm</code>, <code>lg</code>, <code>2x</code>, <code>3x</code>, <code>5x</code>, <code>7x</code>, <code>10x</code>146147 <hr/>148Note: The <code>fa</code> prefix has been deprecated in version 5. The new default is the <code>fas</code> solid style <code>far</code> regular style and the <code>fab</code> style for brands.149150WP Font Awesome plugin still support Font Awesome version 4151152<?php153}154155// Add custom action links156add\_filter( 'plugin\_action\_links\_' . plugin\_basename( \_\_FILE\_\_ ), 'wpfontawesome\_zb\_action\_link' );157158function wpfontawesome\_zb\_action\_link( $links ) {159  $plugin\_links \= array(160    '<a href="' . admin\_url( 'options-general.php?page=wpFontAwesome' ) . '">' . \_\_( 'Help', ZB\_FAWE\_TEXTDOMAIN ) . '</a>',161  );162  return array\_merge( $plugin\_links, $links );163}164165166function wp\_font\_awesome\_add\_mce\_button() {167  // check user permissions168  if ( !current\_user\_can( 'edit\_posts' ) &&  !current\_user\_can( 'edit\_pages' ) ) {169             return;170     }171 // check if WYSIWYG is enabled172 if ( 'true' \== get\_user\_option( 'rich\_editing' ) ) {173     add\_filter( 'mce\_external\_plugins', 'wp\_font\_awesome\_add\_tinymce\_plugin' );174     add\_filter( 'mce\_buttons', 'wp\_font\_awesome\_register\_mce\_button' );175     }176}177add\_action('admin\_head', 'wp\_font\_awesome\_add\_mce\_button');178179// register new button in the editor180function wp\_font\_awesome\_register\_mce\_button( $buttons ) {181  array\_push( $buttons, 'shortcode\_wp\_font\_awesome\_insert' );182  return $buttons;183}184185186// declare a script for the new button187// the script will insert the shortcode on the click event188function wp\_font\_awesome\_add\_tinymce\_plugin( $plugin\_array ) {189  $plugin\_array\['shortcode\_wp\_font\_awesome\_insert'\] \= ZB\_FAWE\_URL .'/script.js';190  return $plugin\_array;191}

CVE-2023-5127: wp-font-awesome.php in wp-font-awesome/trunk – WordPress Plugin Repository

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Osmansorkar Ajax Archive Calendar plugin <= 2.6.7 versions.

**Solution**

 Fixed

Update the WordPress Ajax Archive Calendar plugin to the latest available version (at least 2.6.8).

Found this useful? Thank NGÔ THIÊN AN (ancorn\_ from VNPT-VCI) for reporting this vulnerability. Buy a coffee ☕

NGÔ THIÊN AN (ancorn\_ from VNPT-VCI) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ajax Archive Calendar Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.6.8.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2023-46069: WordPress Ajax Archive Calendar plugin <= 2.6.7 - Cross Site Scripting (XSS) vulnerability - Patchstack

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Peter Keung Peter’s Custom Anti-Spam plugin <= 3.2.2 versions.

**Solution**

 Fixed

Update the WordPress Peter’s Custom Anti-Spam plugin to the latest available version (at least 3.2.3).

SeungYongLee discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Peter’s Custom Anti-Spam Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.2.3.

**No other known vulnerabilities for this plugin**Report

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

Tag

#xss