WordPress plugin WP Editor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-10887 · WordPress · Wp Editor

Name of the Vulnerable Software and Affected Versions: WP Editor WordPress plugin version 1.2.6 and earlier Description: The issue is related to an authenticated blind SQL injection problem. It occurs because the plugin does not properly sanitise or validate its setting fields, allowing an...

CVE-2023-52178

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This issue affects WP Affiliate Disclosure: from n/a through 1.2.7...

PT-2024-14449 · Mojofywp · Mojofywp Wp Affiliate Disclosure

Name of the Vulnerable Software and Affected Versions: MojofyWP WP Affiliate Disclosure versions 1.2.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can...

CVE-2023-45762

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Michael Uno miunosoft Responsive Column Widgets.This issue affects Responsive Column Widgets: from n/a through 1.2.7...

WordPress Plugin Responsive Column Widgets Input Validation Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

PT-2023-29677 · Unknown · Responsive Column Widgets

Name of the Vulnerable Software and Affected Versions: Responsive Column Widgets versions 1.2.7 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to untruste...

CVE-2023-48284

Cross-Site Request Forgery CSRF vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7...

PT-2023-30759 · Woocommerce · Decorator – Woocommerce Email Customizer

Name of the Vulnerable Software and Affected Versions: Decorator – WooCommerce Email Customizer versions 1.2.7 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Decorator – WooCommerce Email Customizer, allowing unauthorized actions. This can be exploited through Cross...

Responsive Column Widgets <= 1.2.7 - Open Redirect via responsive_column_widgets_link

Description The Responsive Column Widgets plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 1.2.7. This is due to insufficient validation on the redirect url supplied via the responsivecolumnwidgetslink parameter. This makes it possible for unauthenticated...

CVE-2023-47520 WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Michael Uno miunosoft Responsive Column Widgets plugin = 1.2.7 versions...

WordPress Plugin Profile Extra Fields by BestWebSoft Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress Plugin...

WordPress Astra Bulk Edit Plugin <= 1.2.7 is vulnerable to Broken Access Control

Software Astra Bulk Edit Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44148 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID eb8e23601d3b Credits Rafie Muhammad Patchstack...

CVE-2023-3501 FormCraft < 1.2.7 - Admin+ Stored XSS

The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2023-25093 · WordPress · Formcraft

Name of the Vulnerable Software and Affected Versions: FormCraft WordPress plugin versions prior to 1.2.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

WordPress Backup Migration Plugin <= 1.2.7 is vulnerable to Broken Access Control

Software Backup Migration Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c3aab82cdff1 Credits WordFence Required privilege...

CVE-2023-23997

Cross-Site Request Forgery CSRF vulnerability in Dave Jesch Database Collation Fix plugin = 1.2.7 versions...

PT-2023-19346 · Unknown · Dave Jesch Database Collation Fix

Name of the Vulnerable Software and Affected Versions: Dave Jesch Database Collation Fix plugin versions 1.2.7 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

CVE-2023-23804

Cross-Site Request Forgery CSRF vulnerability in HasThemes HT Feed plugin = 1.2.7 versions...

PT-2023-19219 · Hasthemes · Ht Feed

Name of the Vulnerable Software and Affected Versions: HasThemes HT Feed plugin versions 1.2.7 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...