WordPress Ninja Pages plugin <= 1.4.2 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Manas Talekar in WordPress Plugin Ninja Pages versions = 1.4.2...

CVE-2024-25921

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Concerted Action Action Network allows Reflected XSS.This issue affects Action Network: from n/a through 1.4.2...

CVE-2024-7099

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit...

CVE-2024-51784

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VietFriend team FriendStore for WooCommerce friendstore-for-woocommerce allows Reflected XSS.This issue affects FriendStore for WooCommerce: from n/a through = 1.4.2...

CVE-2024-11178

The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and brute force the...

Joomla! 安全漏洞

Joomla! is a free, open source content management system from Joomla! A security vulnerability exists in Joomla! JS Jobs versions 1.1.5 through 1.4.2, which stems from the presence of a SQL injection vulnerability that allows an authenticated attacker to execute arbitrary SQL commands via the...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the JSONFileDocumentDatabase during delete and update operations. Remediation Upgrade parlant to version 1.4.2 or higher. References - GitHub Commit...

CVE-2024-12817 Etsy Importer <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Etsy Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'productlink' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress plugin Etsy Importer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

PT-2025-1956 · WordPress · Etsy Importer

Name of the Vulnerable Software and Affected Versions: Etsy Importer plugin for WordPress versions up to, and including, 1.4.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the product lin...

WordPress Simple Downloads List plugin <= 1.4.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Downloads List versions = 1.4.2...

CVE-2024-13594

The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofixsdl' shortcode in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

WordPress plugin Simple Downloads List SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A SQL injection vulnerability...

CVE-2025-23541

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in edmon.parker Download, Downloads ydn-download allows Reflected XSS.This issue affects Download, Downloads : from n/a through = 1.4.2...

CVE-2025-23541 WordPress Download, Downloads plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in edmon.parker Download, Downloads ydn-download allows Reflected XSS.This issue affects Download, Downloads : from n/a through = 1.4.2...

PT-2025-4931 · Unknown · Edmon Download

Name of the Vulnerable Software and Affected Versions: edmon Download, Downloads versions 1.4.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2025-2171 · WordPress · Utilities For Mtg

Name of the Vulnerable Software and Affected Versions: Utilities for MTG plugin for WordPress versions up to, and including, 1.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'mtglink' shortcode due to insufficient input sanitization and output escaping on...

WordPress Download, Downloads plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Download, Downloads versions = 1.4.2...

CVE-2025-22765 WordPress WP Order By Plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Uri Weil WP Order By allows Reflected XSS.This issue affects WP Order By: from n/a through 1.4.2...

PT-2025-3849 · Nec · Aterm Wx3600Hp +1

Name of the Vulnerable Software and Affected Versions: NEC Corporation Aterm WX1500HP versions 1.4.2 and earlier NEC Corporation Aterm WX3600HP versions 1.5.3 and earlier Description: The issue allows an attacker to execute arbitrary OS commands via the network. This can be done through the...