plugin
6 known security issues reported for the Show Hidecollapse Expand WordPress plugin. Most recent disclosed Feb 27, 2023.
Running Show Hidecollapse Expand on your site? Check whether your installed version is affected.
Scan your site free[en] The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege us...
The Show-Hide / Collapse-Expand plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor...
The Show-Hide / Collapse-Expand plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the bg_show_hide_save_plugin_settings() function called via and admin_post hook in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers with minimal permiss...
The Show-Hide / Collapse-Expand plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the bg_show_hide_save_plugin_settings() function called via and admin_post hook in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers with minimal permiss...
No patched version available. An unknown person discovered and reported this Broken Authentication vulnerability in WordPress Show-Hide / Collapse-Expand Plugin. This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might al...
The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them. Furthermore, due to the lack of CSRF check, the issue is also exploitable via CSRF
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free