CVE-2024-8665

The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2024-8665 YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scripting

The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

WordPress YITH Custom Login plugin <= 1.7.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin YITH Custom Login versions = 1.7.3...

PT-2024-39163 · Yith · Yith Custom Login

Name of the Vulnerable Software and Affected Versions: YITH Custom Login plugin for WordPress versions up to, and including, 1.7.3 Description: The YITH Custom Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping o...

WordPress plugin YITH Custom Login 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-5799

The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as Contributors to perform Cross-Site Scripting attacks...

WordPress plugin CM Pop-Up Banners 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2024-37163 · WordPress · Cm Pop-Up Banners

Name of the Vulnerable Software and Affected Versions: CM Pop-Up Banners for WordPress versions prior to 1.7.3 Description: The issue allows high privilege users, such as Contributors, to perform Cross-Site Scripting attacks due to the plugin not sanitising and escaping some of its popup fields...

WordPress Web Directory Free plugin < 1.7.3 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by Simone Onofri, Kim Cerra, Andrea De Dominicis in WordPress Plugin Web Directory Free versions 1.7.3...

WordPress plugin Web Directory Free 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in th...

CVE-2024-41677 Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik

Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the render-ssr.ts file. It sometimes...

PT-2024-29502 · Qwik +1 · Qwik +1

Name of the Vulnerable Software and Affected Versions: Qwik versions prior to 1.6.0 @builder.io/qwik versions prior to 1.7.3 Description: A potential mutation XSS vulnerability exists in Qwik due to improper HTML escaping on server-side rendering. This occurs because Qwik converts strings accordi...

PT-2024-28385 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.7.3 Description: A cross-site scripting XSS vulnerability in the Backend Theme Management module allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For Z-BlogPHP version 1.7.3...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop pkisotope version 1.7.3 and prior versions, which originates from...

PT-2024-27125 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: PrestaShop module "Isotope" pk isotope versions =1.7.3 Description: The issue allows attackers to obtain sensitive information and cause other impacts via the pk isotope::saveData and pk isotope::removeData methods. Recommendations: For...

PT-2024-26625 · Bestwebsoft · Contact Form To Db

Name of the Vulnerable Software and Affected Versions: Contact Form to DB by BestWebSoft versions 1.7.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation...

WordPress Borderless plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra in WordPress Plugin Borderless versions = 1.7.3...

image-optimizer 安全漏洞

image-optimizer is an open source package from Spatie. It can run PNG, JPG, WEBP, AVIF, SVG and GIF through a range of various image optimization tools. A security vulnerability exists in versions of image-optimizer prior to 1.7.3 that stems from allowing PHAR deserialization...

PT-2024-25943 · Unknown · Image Optimizer

Name of the Vulnerable Software and Affected Versions: image-optimizer versions prior to 1.7.3 Description: The issue allows PHAR deserialization, for example, using the phar:// protocol in arguments to the file exists function. Recommendations: For versions prior to 1.7.3, update to version 1.7....

WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Masteriyo - LMS versions = 1.7.3...