CVE-2024-9068

The OneElements – Best Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-39403 · WordPress · The Oneelements – Best Elementor Addons

Name of the Vulnerable Software and Affected Versions: The OneElements – Best Elementor Addons plugin for WordPress versions up to, and including, 1.3.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping...

Security Bulletin: Vulnerabilities in Apache Ant affect IBM Operations Analytics - Log Analysis (CVE-2020-11023, CVE-2020-23064, CVE-2020-11022)

Summary There are multple cross site scripting vulnerabilities in Apache Ant that effect IBM Operations Analytics - Log Analysis. These have been addressed. Vulnerability Details CVEID:CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of...

WordPress YayExtra plugin <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function vulnerability

Unauthenticated Arbitrary File Upload via handleuploadfile Function vulnerability discovered by wesley wcraft in WordPress Plugin YayExtra versions = 1.3.7...

PT-2024-38214 · WordPress · Yayextra – Woocommerce Extra Product Options

Name of the Vulnerable Software and Affected Versions: YayExtra – WooCommerce Extra Product Options plugin for WordPress versions up to, and including, 1.3.7 Description: The issue is related to arbitrary file uploads due to missing file type validation in the handle upload file function. This...

MAL-2024-7833 Malicious code in noc-chatbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 404db7a5f4f99325b3d619a50290cc88ef3bdd8cc789301a4d3c54c655a20418 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-27635 · Unknown · Uusweb.Ee Ws Contact Form

Name of the Vulnerable Software and Affected Versions: UusWeb.Ee WS Contact Form versions 1.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations...

WordPress i-amaze theme <= 1.3.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme i-amaze versions = 1.3.7...

WordPress WS Contact Form plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by younsoung kim, SeoHyeon Lee, MyungJu Kim, SeoHee Kang in WordPress Plugin WS Contact Form versions = 1.3.7...

WordPress WS Contact Form Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software WS Contact Form Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37537 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9166c1a50a0c Credits younsoung kim, SeoHyeon Lee, MyungJu...

WordPress Metro Magazine theme <= 1.3.7 - Broken Access Control on Notice Dismissal vulnerability

Broken Access Control on Notice Dismissal vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Metro Magazine versions = 1.3.7...

CVE-2024-5468

The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stmhbdelete function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to...

WordPress plugin Pearl security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Header Builder Plugin – Pearl < 1.3.8 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion

Description The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stmhbdelete function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated...

WordPress Popup Maker WP Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Popup Maker WP Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34770 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7bf55dc1ca78 Credits Rayhan Ramdhany Hanaputra Require...

WordPress plugin TweetScroll Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-25580 · Unknown · Tweetscroll Widget

Name of the Vulnerable Software and Affected Versions: TweetScroll Widget versions 1.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in the TweetScroll Widget...

WordPress TweetScroll Widget Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software TweetScroll Widget Type Plugin Vulnerable versions = 1.3.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33948 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 3dc090758c1a Credits Joshua Chan Required privilege...

WordPress Pearl Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Pearl Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4000 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 24b9141edb4a Credits Krzysztof Zając Required privilege...

PT-2024-24292 · Polevaultweb · Polevaultweb Intagrate Lite

Name of the Vulnerable Software and Affected Versions: Polevaultweb Intagrate Lite versions 1.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations:...