265 matches found
WordPress plugin WooCommerce Warranty Requests Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-14154 · Woocommerce · Woocommerce Warranty Requests
Name of the Vulnerable Software and Affected Versions: WooCommerce Warranty Requests versions 2.2.7 and earlier Description: The issue is related to a Missing Authorization vulnerability in Woo WooCommerce Warranty Requests. This vulnerability affects WooCommerce Warranty Requests from version n/...
GHSA-8J7C-682X-R9F2 Magento RCE,XSS and other vulnerabilities
Magento Commerce and Open Source 2.3.0, 2.2.7 and 2.1.16 contain multiple security enhancements that help close Remote Code Execution RCE, Cross-Site Scripting XSS and other vulnerabilities...
WordPress plugin Popup Box 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
WordPress Popup Box Plugin < 2.2.7 is vulnerable to Cross Site Request Forgery (CSRF)
Software Popup Box Type Plugin Vulnerable versions 2.2.7 Fixed in 2.2.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3477 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d1f8f6b4cec4 Credits Bob Matyas Required privileg...
PT-2024-25185 · Unknown · Fme Modules Customfields
Name of the Vulnerable Software and Affected Versions: FME Modules customfields versions 2.2.7 and before Description: A Directory Traversal issue allows a remote attacker to obtain sensitive information via the "Custom Checkout Fields, Add Custom Fields to Checkout" parameter of the "ajax.php"...
WordPress All-in-one Like Widget plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin All-in-one Like Widget versions = 2.2.7...
WordPress All-in-one Like Widget Plugin <= 2.2.7 is vulnerable to Cross Site Scripting (XSS)
Software All-in-one Like Widget Type Plugin Vulnerable versions = 2.2.7 Fixed in 2.2.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32815 Patch priority Low CVSS severity Low 5.9 Developer Jeroen Peters PSID 19340c2d052a Credits Joshua Chan Required privilege...
WordPress Carousel Slider plugin < 2.2.7 - Editor+ Stored XSS vulnerability
Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Carousel Slider versions 2.2.7...
WordPress Plugin Carousel Slider 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
PT-2024-18243 · WordPress · Carousel Slider
Name of the Vulnerable Software and Affected Versions: Carousel Slider WordPress plugin versions prior to 2.2.7 Description: The Carousel Slider WordPress plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site...
CVE-2024-0235
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog...
PT-2024-15400 · WordPress · Eventon
Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 4.5.5 EventON WordPress plugin versions prior to 2.2.7 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before outputting it back in pages. This lea...
PT-2024-15401 · WordPress · Eventon
Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 4.5.5 EventON WordPress plugin versions prior to 2.2.7 Description: The issue allows unauthenticated users to retrieve email addresses of any users on the blog due to a lack of authorization in an AJ...
WordPress EventON Plugin <= 2.2.7 is vulnerable to Broken Access Control
Software EventON Type Plugin Vulnerable versions = 2.2.7 Fixed in 2.2.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6158 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 05f91c2608b0 Credits Francesco Carlucci Required privilege...
WordPress WooCommerce Warranty Requests Plugin <= 2.2.7 is vulnerable to Broken Access Control
Software WooCommerce Warranty Requests Type Plugin Vulnerable versions = 2.2.7 Fixed in 2.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51495 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 718f302faa3f Credits Rafie Muhammad...
PT-2023-23633 · WordPress · Adastra Crypto Cryptocurrency Payment & Donation Box
Name of the Vulnerable Software and Affected Versions: Adastra Crypto Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free versions n/a through 2.2.7 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQ...
CVE-2021-4355 Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the downloadorderdetaillist, changeorderlist, and downloadmemberlist functions called via admininit hooks in versions up to, and including, 2.2.7. This makes it possible for...
PT-2023-12486 · WordPress · Welcart E-Commerce
Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce plugin for WordPress versions up to, and including, 2.2.7 Description: The issue allows authenticated attackers to bypass authorization and download sensitive information, including WordPress settings, plugin settings, PHP...