The QuickCal plugin for WordPress has a Stored Cross-Site Scripting vulnerability via Custom Field Parameters in all versions up to, and including, 1.0.20. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute when a user accesses an injected page. The vulnerability is caused by insufficient input sanitization and output escaping in the QuickCal plugin. The nonce guar [truncated]
A Deserialization of Untrusted Data vulnerability in the Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection. This issue affects versions from n/a before 3.1.5. The vulnerability could potentially allow attackers to inject malicious objects, which could lead to various impacts including data breaches or system compromise. Defenders should verify exposure and apply patches, [truncated]
