7307 matches found
CVE-2024-11190
The jwp-a11y WordPress plugin (versions 4.1.7 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain settings are not properly sanitised and escaped , allowing high-privilege users, such as administrators, to perform XSS attacks. This vulnerability persi...
CVE-2024-11221 Full Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSS
The Full Screen Page Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...
CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed f...
CVE-2024-10475
The Responsive Contact Form Builder & Lead Generation Plugin for WordPress, in versions prior to 1.9.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as admin...
CVE-2024-10009 Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection
The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2025-47785
CVE-2025-47785 affects Emlog up to version 2.5.9. The issue is a SQL injection in the $origContent parameter of admin/article_save.php, which is accessible to ordinary registered users. This can induce SQL injection when the registered site is enabled, potentially allowing the injection of the ad...
CVE-2025-2570 System Admin Cannot Access Environment settings in System Console While System Manager Can
Mattermost versions 10.5.x = 10.5.3, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...
CVE-2025-2570
Mattermost CVE-2025-2570 affects Mattermost Server versions 10.5.x ≤ 10.5.3 and 9.11.x ≤ 9.11.11. Root cause: the system fails to enforce RestrictSystemAdmin when a user lacks access to ExperimentalSettings, allowing a System Manager to access ExperimentSettings via the System Console. Impact: ex...
CVE-2024-13914
The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 file-manager-advanced-shortcode and 2.5.6 advanced-file-manager-pro-premium, via the 'filemanageradvanced' shortcode. This makes it possible for authenticated...
WordPress plugin Jetpack Boost has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2025-21507 · WordPress · Secure Downloads
Name of the Vulnerable Software and Affected Versions: Secure Downloads WordPress plugin versions prior to 1.2.3 Description: The issue allows authenticated attackers with admin-level access and above to download arbitrary files, potentially containing sensitive information, such as the...
PT-2025-21429 · WordPress · Prisna Gwt Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: Prisna GWT WordPress plugin versions prior to 1.4.14 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...
PT-2025-21550
Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager versions prior to 2.2.2 Description: The issue allows a logged-in admin to download system files outside of the WordPress directory. This is a significant concern as it could potentially expose sensitive system...
CVE-2024-13940 Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook
The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitra...
CVE-2024-13940
CVE-2024-13940: Ninja Forms Webhooks for WordPress
PT-2025-16: Disclosure of sensitive data in Booco
The vulnerability was identified in Booco, versions 2.38, 2.39 The discovered vulnerability allows an unauthorized attacker to obtain administrator rights to the system, including access to all its data and functionality. Vulnerability status: Confirmed by vendor Date of vulnerability remediation...
Fortinet Fortigate TACACS+ authentication bypass (FG-IR-24-472)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-472 advisory. - A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager...
PT-2025-20526
Name of the Vulnerable Software and Affected Versions SourceCodester Online Student Clearance System version 1.0 Description A critical issue has been identified, affecting the /admin/edit-admin.php file, where the manipulation of the txtfullname, txtemail, and cmddesignation arguments leads to S...
WordPress Depicter Plugin 3.6.1 - SQL Injection
Exploit Title: WordPress Depicter Plugin 3.6.1 - SQL Injection Google Dork: inurl:/wp-content/plugins/depicter/ Date: 2025-05-06 Exploit Author: Andrew Long datagoboom Vendor Homepage: https://wordpress.org/plugins/depicter/ Software Link: https://downloads.wordpress.org/plugin/depicter.3.6.1.zip...