151 matches found
CVE-2023-24009
Auth. subscriber+ Reflected Cross-site Scripting XSS vulnerability in Wpazure Themes Upfrontwp theme = 1.1 versions...
CVE-2023-2249
The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is due to the insecure use of filegetcontents without appropriate verification of the data being supplied to the function...
CVE-2023-1895
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the getremotecontent REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary...
CVE-2022-45812
Auth. subscriber+ Stored Cross-Site Scripting XSS vulnerability in Martin Lees Exxp plugin = 2.6.8 versions...
CVE-2023-27619
Auth subscriber+ Reflected Cross-Site Scripting XSS vulnerability in Macho Themes Regina Lite theme = 2.0.7 versions...
CVE-2022-4935
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...
CVE-2022-45369
Auth. subscriber+ Broken Access Control vulnerability in Plugin for Google Reviews plugin = 2.2.2 on WordPress...
CVE-2022-41788
Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Soledad premium theme = 8.2.5 on WordPress...
CVE-2022-36341
Authenticated subscriber+ plugin settings change leading to Stored Cross-Site Scripting XSS vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin = 1.0 at WordPress...