WordPress Essential Blocks plugin <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by João Pedro Soares de Alcântara in WordPress Plugin Essential Blocks for Gutenberg versions = 4.5.12...

WordPress Master Addons for Elementor plugin <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by João G. Barbosa 4rCanJ0x! in WordPress Plugin Master Addons for Elementor versions = 2.0.6.0...

WordPress Elementor Header & Footer Builder plugin <= 1.6.26 - Authenticated (Author+) HTML Injection vulnerability

Authenticated Author+ HTML Injection vulnerability discovered by wesley wcraft in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 1.6.26...

WordPress ShiftController Employee Shift Scheduling plugin <= 4.9.57 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin ShiftController Employee Shift Scheduling versions = 4.9.57...

WordPress Elementor Header & Footer Builder plugin <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 1.6.28...

WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scripting vulnerability

Authenticated Contributer+ Stored Cross-Site Scripting vulnerability discovered by andrea bocchetti in WordPress Plugin Post and Page Builder by BoldGrid versions = 1.26.4...

PT-2024-33828 · Ligowave · Ligowave Pro +3

Name of the Vulnerable Software and Affected Versions: Ligowave UNITY versions through 6.95-2 Ligowave PRO versions through 6.95-1.Rt3883 Ligowave MIMO versions through 6.95-1.Rt2880 Ligowave APC Propeller versions through 2-5.95-4.Rt3352 Description: A vulnerability in the web-based management...

WordPress SP Project & Document Manager plugin <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update vulnerability

Authenticated Subscriber+ Arbitrary Folder Name Update vulnerability discovered by fewwords huang in WordPress Plugin SP Project & Document Manager versions = 4.70...

WordPress Xpro Elementor Addons plugin <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by stealthcopter in WordPress Plugin Xpro Elementor Addons versions = 1.4.3...

WordPress Image Optimization by Optimole plugin <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG Upload vulnerability discovered by wesley wcraft in WordPress Plugin Optimole versions = 3.12.10...

WordPress Exclusive Addons for Elementor plugin <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Team Member Widget vulnerability discovered by wesley wcraft in WordPress Plugin Exclusive Addons Elementor versions = 2.6.9.6...

Envo's Elementor Templates & Widgets for WooCommerce < 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-32350

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an authenticated remote command execution RCE vulnerability via the "ipsecPsk" parameter in the "cstecgi.cgi" binary...

CVE-2024-32352

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an authenticated remote command execution RCE vulnerability via the "ipsecL2tpEnable" parameter in the "cstecgi.cgi" binary...

CVE-2024-32349

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an authenticated remote command execution RCE vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary...

WordPress Alt Text AI plugin <= 1.4.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Lucio Sá in WordPress Plugin Download Alt Text AI versions = 1.4.9...

WordPress Borderless plugin <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by stealthcopter in WordPress Plugin Borderless versions = 1.5.3...

Desdev DedeCMS 安全漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS from China's Zhuozhuo Network Desdev. The system features content publishing, content management, content editing and content retrieval. A security vulnerability exists in DedeCMS versi...

WordPress Blocksy Companion plugin <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via SVG Uploads vulnerability discovered by wesley wcraft in WordPress Plugin Blocksy Companion versions = 2.0.45...

WordPress Pods plugin <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Pod Form Redirect URL vulnerability discovered by wesley wcraft in WordPress Plugin Pods versions = 3.2.1...