CVE-2024-0667

The CVE concerns the WordPress plugin Form Maker by 10Web (Mobile-Friendly Drag & Drop Form Builder). A Cross-Site Request Forgery (CSRF) flaw exists in versions up to and including 1.15.21, caused by missing or incorrect nonce validation on the plugin’s execute function. This allows an unauthent...

CVE-2024-0667: Inappropriate Source Code Style or Formatting

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.15.21. This is due to missing or incorrect nonce validation on the 'execute' function. This makes it possible for...

WordPress 10Web AI Assistant Plugin <= 1.0.18 is vulnerable to Broken Access Control

Software 10Web AI Assistant Type Plugin Vulnerable versions = 1.0.18 Fixed in 1.0.19 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6985 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 64e97c95dab3 Credits Krzysztof Zając...

PT-2024-15395

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to, and including, 1.8.19 Description The issue allows authenticated attackers to rename arbitrary files on the server via the rename item function,...

WordPress Photo Gallery by 10Web Plugin <= 1.8.19 is vulnerable to Directory Traversal

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.19 Fixed in 1.8.20 OWASP Top 10 A4: Insecure Design Classification Directory Traversal CVE CVE-2024-0221 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 29011d5256be Credits Bence Szalai Required privile...

CVE-2023-6924

CVE-2023-6924 affects the Photo Gallery by 10Web WordPress plugin. It is a Stored XSS via widgets caused by insufficient input sanitization and output escaping on user-supplied attributes, playable by authenticated admins, above-admins, or contributors with a page builder plugin. Versions up to a...

CVE-2023-5559

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service...

Design/Logic Flaw

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service...

CVE-2023-5559

The 10Web Booster WordPress plugin, in versions prior to 2.24.18 , is vulnerable to a design flaw where it fails to validate the option name provided during certain AJAX actions . This oversight allows unauthenticated users to delete arbitrary options directly from the database, which can result ...

PT-2023-32175

Name of the Vulnerable Software and Affected Versions 10Web Booster WordPress plugin versions prior to 2.24.18 Description The issue allows unauthenticated users to delete arbitrary options from the database, leading to denial of service, due to the lack of validation of the option name given to...

CVE-2023-5559: Undefined Security Weakness

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service...

10Web Map Builder for Google Maps < 1.0.74 - Cross-Site Request Forgery to Notice Dismissal

Description The 10Web Map Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.73. This is due to missing or incorrect nonce validation on the gmwdbpinstallnoticestatus function. This makes it possible for unauthenticated attackers to...

Seo By 10Web <= 1.2.9 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-34375

Unauth. Reflected Cross-Site Scripting XSS vulnerability in 10Web SEO by 10Web plugin = 1.2.9 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in 10Web SEO by 10Web plugin = 1.2.9 versions...

CVE-2023-34375

CVE-2023-34375 concerns the WordPress plugin “SEO by 10Web” (versions ≤ 1.2.9). The vulnerability is an unauthenticated reflected Cross‑Site Scripting (XSS) that could be exploited by an attacker without credentials. Public writeups in the connected data confirm the flaw exists in this plugin ver...

CVE-2023-34375 WordPress Seo By 10Web Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in 10Web SEO by 10Web plugin = 1.2.9 versions...

CVE-2023-34375: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in 10Web SEO by 10Web plugin = 1.2.9 versions...

PT-2023-24848

Name of the Vulnerable Software and Affected Versions 10Web SEO by 10Web plugin versions 1.2.9 and earlier Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

WordPress Seo By 10Web Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Seo By 10Web Type Plugin Vulnerable versions = 1.2.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34375 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 68446366bf16 Credits Le Ngoc Anh Required...