Foxyshop Vulnerabilities

[en] The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

Affected:

up to 4.8.2

Fixed in:

4.8.2

Disclosed:

Jul 11, 2022

CVE-2022-1220 on NVD →

The FoxyShop plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfu...

CVSS:

6.1

Affected:

up to 4.8.1

Fixed in:

4.8.2

Disclosed:

Jun 16, 2022

CVE-2022-1220 on NVD →

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 4.6.1

Fixed in:

4.6.1

Disclosed:

May 14, 2015

Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

CVSS:

6.1

Affected:

up to 4.6.1

Fixed in:

4.6.1

Disclosed:

Aug 1, 2014

CVE-2013-6837 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

Affected:

up to 4.6.1

Fixed in:

4.6.1

Disclosed:

Dec 19, 2013

CVE-2013-6837 on NVD →

The jQuery prettyPhoto library bundled with many plugins was found to be vulnerable to DOM Cross-Site Scripting (XSS).

Affected:

up to 4.6.1

Fixed in:

4.6.1