1301 matches found
PT-2023-14213 · WordPress · All-In-One Security
Name of the Vulnerable Software and Affected Versions: All-In-One Security AIOS WordPress plugin versions prior to 5.1.3 Description: The issue concerns a leak of plugin settings, including the email address used by the plugin. Recommendations: For All-In-One Security AIOS WordPress plugin versio...
CVE-2022-4256
The CVE concerns WordPress plugin All-in-One Addons for Elementor (WidgetKit) variants prior to version 2.4.4. Root cause: the plugin does not fully sanitise/escape certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disabled (notably in multi...
CVE-2022-4256 All-in-One Addons for Elementor - WidgetKit < 2.4.4 - Admin+ Stored XSS
The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...
CVE-2022-4256: Undefined Security Weakness
The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...
WordPress plugin All-in-One Addons for Elementor 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-14139 · WordPress · All-In-One Addons For Elementor
Name of the Vulnerable Software and Affected Versions: All-in-One Addons for Elementor WordPress plugin versions prior to 2.4.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowe...
CVE-2022-4097 All In One WP Security & Firewall < 5.0.8 - IP Spoofing
The All-In-One Security AIOS WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features like IP blocks, rate limiting, brute force protection, and more...
CVE-2022-4097
The CVE-2022-4097 entry concerns the All-In-One Security (AIOS) WordPress plugin prior to 5.0.8. The root cause is IP spoofing via headers (e.g., HTTP_X_REAL_IP/HTTP_X_FORWARDED_FOR) in get_user_ip_address(), allowing attackers to bypass security controls such as IP blocks, rate limiting, and bru...
WordPress plugin All-In-One Security 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
CVE-2022-4097: Authorization Bypass Through User-Controlled Key
The All-In-One Security AIOS WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features like IP blocks, rate limiting, brute force protection, and more...
CVE-2022-44737
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security AIOS – Security and Firewall WordPress plugin = 5.1.0 on WordPress...
CVE-2022-44737
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security AIOS – Security and Firewall WordPress plugin = 5.1.0 on WordPress...
CVE-2022-44737
CVE-2022-44737 affects the WordPress All-In-One Security (AIOS) – Security and Firewall plugin, = 5.1.1) or apply vendor-provided fixes. Other references corroborate CSRF risk in AIOS ≤ 5.1.0 and advise updating.
PT-2022-27291
Name of the Vulnerable Software and Affected Versions All-In-One Security AIOS – Security and Firewall WordPress plugin versions = 5.1.0 Description The issue concerns Multiple Cross-Site Request Forgery vulnerabilities. These vulnerabilities are present in the All-In-One Security AIOS – Security...
CVE-2022-44737: Cross-Site Request Forgery (CSRF)
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security AIOS – Security and Firewall WordPress plugin = 5.1.0 on WordPress...
All-In-One Security < 5.1.1 - Bulk Actions via CSRF
The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as delete arbitrary blocked IPs via CSRF attacks...
WordPress All in One SEO Pro Server-Side Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A server-side request forge...
CVE-2022-42494
Server Side Request Forgery SSRF vulnerability in All in One SEO Pro plugin = 4.2.5.1 on WordPress...
