WordPress WP Announcement Plugin <=2.0.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Announcement Type Plugin Vulnerable versions =2.0.8 Fixed in 2.0.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38685 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6b93ac81fa76 Credits Rayhan Ramdhany Hanaputra Required...

WordPress plugin wpForo Forum security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin PropertyHive versions = 2.0.9...

GHSA-H97C-QP24-439V Insecure State Generation in laravel/socialite

laravel/socialite versions prior to 2.0.9 are found to have an insecure state generation mechanism, potentially exposing the OAuth authentication process to security risks. The issue has been addressed in version 2.0.9 by ensuring that the state is generated using a truly random approach, enhanci...

CVE-2024-3405 WP Prayer <= 2.0.9 - Settings Update via CSRF

The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress plugin WP Prayer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress WP Prayer Plugin <= 2.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Prayer Type Plugin Vulnerable versions = 2.0.9 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3405 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fe4f86d8e888 Credits Bob Matyas Required privileg...

WordPress Themify Shortcodes plugin <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via themifybutton Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Themify Shortcodes versions = 2.0.9...

WordPress plugin Edge 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-25835 · Unknown · Theme Freesia Edge

Name of the Vulnerable Software and Affected Versions: Theme Freesia Edge versions n/a through 2.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can injec...

PT-2024-23275 · WordPress · Announcekit

Name of the Vulnerable Software and Affected Versions: AnnounceKit plugin for WordPress versions up to, and including, 2.0.9 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated...

WordPress AnnounceKit Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)

Software AnnounceKit Type Plugin Vulnerable versions = 2.0.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3023 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f7885f732c7f Credits Benedictus Jovan Required...

CVE-2024-25852

Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. An attacker can use the vulnerability to obtain device administrator rights...

CVE-2024-27985

Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9...

CVE-2024-27985

Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9...

PT-2024-21165 · Linksys · Linksys Re7000

Name of the Vulnerable Software and Affected Versions: Linksys RE7000 versions 2.0.9 through 2.0.15 Description: The issue concerns a command execution vulnerability in the AccessControlList parameter of the access control function point. This vulnerability can be exploited by an attacker to obta...

WordPress Mighty Classic Pros And Cons plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Mighty Classic Pros And Cons versions = 2.0.9...

CVE-2023-48220 Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period

Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the deviseinvitable gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable...

WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software MailerLite – WooCommerce integration Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52223 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c583a3f3b217 Credit...

CVE-2023-49897

An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...