WordPress Charity Addon for Elementor Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Charity Addon for Elementor Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44026 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8bb1c1474af8 Credits João Pedro S Alcântara...

PT-2024-12112 · Unknown · Cs-Cart Multivendor

Name of the Vulnerable Software and Affected Versions: CS-Cart MultiVendor version 4.16.1 Description: A Directory Traversal vulnerability allows remote attackers to run arbitrary code via a crafted zip file when installing a new add-on. This issue enables attackers to potentially execute malicio...

WordPress Restaurant & Cafe Addon for Elementor Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS)

Software Restaurant & Cafe Addon for Elementor Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44032 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fe8ab7d9930f Credits João Pedro S...

WordPress Medical Addon for Elementor Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Medical Addon for Elementor Type Plugin Vulnerable versions = 1.6.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44024 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2feb17bc52f9 Credits João Pedro S Alcântara Kinor...

WordPress Gum Elementor Addon Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Gum Elementor Addon Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44027 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID deeeb1b651c5 Credits João Pedro S Alcântara Kinorth...

WordPress Gum Elementor Addon plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ghsinfosec Patchstack Alliance in WordPress Plugin Gum Elementor Addon versions = 1.3.7...

WordPress Gum Elementor Addon Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Gum Elementor Addon Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44035 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 73298ffb7a63 Credits ghsinfosec Required privilege...

CVE-2024-8742

CVE-2024-8742 affects the WordPress plugin Essential Addons for Elementor (vulnerable up to and including 6.0.3). The issue is a Stored Cross-Site Scripting in the Filterable Gallery widget caused by insufficient input sanitization and output escaping. Exploitation requires an authenticated user ...

CVE-2023-2919

The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addonenabledisable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a...

CVE-2023-2919

The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addonenabledisable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a...

WordPress Tutor LMS plugin <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' vulnerability

Cross-Site Request Forgery via 'addonenabledisable' vulnerability discovered by Ram in WordPress Plugin Tutor LMS versions = 2.7.4...

PT-2024-12208 · WordPress · Tutor Lms

Name of the Vulnerable Software and Affected Versions: Tutor LMS plugin for WordPress versions up to, and including, 2.7.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the addon enable disable function. This allows unauthenticated...

CVE-2024-8292

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

CVE-2024-8292

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

CVE-2024-8292

CVE-2024-8292 affects WP-Recall – Registration, Profile, Commerce & More for WordPress (versions

CVE-2024-8292 WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

CVE-2024-8292 WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

PT-2024-38920 · WordPress · Wp-Recall

Name of the Vulnerable Software and Affected Versions: WP-Recall – Registration, Profile, Commerce & More plugin for WordPress versions up to, and including, 16.26.8 Description: The WP-Recall plugin for WordPress is vulnerable to privilege escalation/account takeover due to improper verification...

CVE-2024-7122

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-7122

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...