The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the PHP_SELF variable in all versions up to and including 1.2.4. The vulnerability stems from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. Successful exploitation requires user interaction, such as tricking a victim into clicki [truncated]
The NS IE Compatibility Fixer plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to, and including, 2.1.5. This is due to missing nonce validation on settings updates. An unauthenticated attacker could modify plugin settings by tricking administrators into performing actions like clicking a link. The vulnerability allows for unauthorized changes to plugin setting [truncated]
