WordPress Easy Custom Code (LESS/CSS/JS) Plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Easy Custom Code LESS/CSS/JS – Live editing versions = 1.0.8...

WordPress Easy Custom Code (LESS/CSS/JS) – Live editing Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

Software Easy Custom Code LESS/CSS/JS – Live editing Type Plugin Vulnerable versions = 1.0.8 Fixed in 1.0.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37536 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9a38a57946fb Credits Cronus...

ResourcePack Server Security Vulnerability

ResourcePack Server is a small server hosting server resource pack by Brian Duan, an individual developer in China. A security vulnerability exists in iceice666 ResourcePack Server versions prior to v1.0.8, which stems from a vulnerability that allows remote attackers to disclose files on the...

PT-2024-26512 · Unknown · Iceice666 Resourcepack Server

Name of the Vulnerable Software and Affected Versions: iceice666 ResourcePack Server versions prior to 1.0.8 Description: A Directory Traversal issue allows a remote attacker to disclose files on the server. The issue is related to the setPath in ResourcePackFileServer.kt. Recommendations: For...

PT-2024-14124 · Unknown · Universal Passport Rx

Name of the Vulnerable Software and Affected Versions: UNIVERSAL PASSPORT RX versions 1.0.0 through 1.0.8 Description: A cross-site scripting issue exists, which may allow a remote authenticated attacker with administrative privileges to execute an arbitrary script on the user's web browser...

WordPress Swiss Toolkit For WP Plugin <= 1.0.7 is vulnerable to Broken Authentication

Software Swiss Toolkit For WP Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2024-5204 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 07e08699642a Credits István Márton...

CVE-2024-5092

The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Switcher, Slider, and Iconbox widgets in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

WordPress Elegant Addons for elementor plugin <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via HTML tags vulnerability discovered by João G. Barbosa 4rCanJ0x! in WordPress Plugin Elegant Addons for elementor versions = 1.0.8...

VulnCheck KEV: CVE-2018-13307

System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certain payloads cause the device to become permanently inoperable...

WordPress Plugin Elegant Addons for elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

Security Bulletin: Vulnerabilities in Node.js and packages affect IBM Voice Gateway

Summary Security Vulnerabilities in Node.js and packages affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2024-31206 DESCRIPTION: Node.js dectalk-tts module could allow a remote attacker to obtain sensitive information, caused by the use of...

WordPress plugin BlogLentor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

WordPress Niveau theme 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Niveau versions = 1.0.8...

PT-2024-25874 · Wpsurface · Bloglentor

Name of the Vulnerable Software and Affected Versions: wpsurface BlogLentor versions 1.0.0 through 1.0.8 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Stored XSS vulnerability. This allows for the storage of malicious scripts in...

PT-2024-25441 · Extend Themes · Extend Themes Colibri Wp +6

Name of the Vulnerable Software and Affected Versions: Extend Themes Pathway versions 1.0.15 and earlier Extend Themes Hugo WP versions 1.0.8 and earlier Extend Themes Althea WP versions 1.0.13 and earlier Extend Themes Elevate WP versions 1.0.15 and earlier Extend Themes Brite versions 1.0.11 an...

WordPress Hugo WP theme <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Hugo WP versions = 1.0.8...

WordPress Hugo WP Theme <= 1.0.8 is vulnerable to Broken Access Control

Software Hugo WP Type Theme Vulnerable versions = 1.0.8 Fixed in 1.0.10 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33686 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b2b5b58a00f1 Credits Dhabaleshwar Das Required privilege...

CVE-2024-32538

CVE-2024-32538 affects the Easy CountDowner WordPress plugin. The issue is described as a Cross-Site Request Forgery (CSRF) vulnerability that allows Stored XSS in Easy CountDowner versions up to 1.0.8 (and affected path listed as n/a through 1.0.8). The connected Red Hat and Wordfence entries co...

WordPress Plugin Easy CountDowner 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability...

WordPress Easy CountDowner plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Easy CountDowner versions = 1.0.8...