PT-2024-38916 · WordPress · The Guten Post Layout

Name of the Vulnerable Software and Affected Versions: The Guten Post Layout – An Advanced Post Grid Collection for WordPress versions up to, and including, 1.2.4 Description: The issue is related to Stored Cross-Site Scripting via the align attribute within the 'wp:guten-post-layout/post-grid'...

WordPress Iconize plugin <= 1.2.4 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Iconize versions = 1.2.4...

WordPress Mega Elements – Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Mega Elements versions = 1.2.4...

WordPress Contact Form to Any API plugin <= 1.2.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form vulnerability

Unauthenticated Stored Cross-Site Scripting via Contact Form vulnerability discovered by Jorgson in WordPress Plugin Contact Form to Any API versions = 1.2.4...

WordPress Amelia plugin <= 1.2.4 - Missing Authorization to Sensitive Information Exposure vulnerability

Missing Authorization to Sensitive Information Exposure vulnerability discovered by Nadim Zubidat in WordPress Plugin Amelia versions = 1.2.4...

OPENSUSE-SU-2024:14316-1 nqptp-1.2.4-1.1 on GA media

These are all security issues fixed in the nqptp-1.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

WordPress Opal Membership plugin <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Karolina Jankowska in WordPress Plugin Opal Membership versions = 1.2.4...

WordPress plugin Filr 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

PT-2024-30379 · Filr · Filr

Name of the Vulnerable Software and Affected Versions: Filr – Secure document library versions 1.2.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

WordPress plugin Opal Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Opal Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-38479 · WordPress · Opal Membership

Name of the Vulnerable Software and Affected Versions: Opal Membership plugin for WordPress versions up to and including 1.2.4 Description: The issue allows authenticated attackers with subscriber-level access and above to view private notes that should be restricted to administrators. This is...

WordPress Filr plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by domiee13 Patchstack Alliance in WordPress Plugin Filr versions = 1.2.4...

WordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Plugin ElementInvader Addons for Elementor versions = 1.2.4...

WordPress Lawyer Landing Page theme <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Lawyer Landing Page versions = 1.2.4...

Lunary Access Control Error Vulnerability

Lunary is a production toolkit for LLM from lunary open source. An access control error vulnerability exists in lunary version 1.2.4, which stems from the backend failing to validate the project identifier against the current user's organization ID and the project it belongs to, as well as a...

CVE-2024-35762

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Cryout Creations Serious Slider allows Stored XSS.This issue affects Serious Slider: from n/a through 1.2.4...

WordPress Serious Slider plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Serious Slider versions = 1.2.4...

OPENSUSE-SU-2024:12504-1 libfpm_pb0-1.2.4-5.1 on GA media

These are all security issues fixed in the libfpmpb0-1.2.4-5.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-5133

In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the GET /v1/users/me/org endpoint, which...