Sticky Buttons < 3.2.4 - Button Deletion via CSRF

Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks PoC Make a logged in admin open an HTML file where ID is a valid ID: action...

Wow Skype Buttons < 4.0.4 - Button Deletion via CSRF

Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks PoC As an admin open HTML file containing: action...

Easy Social Share Buttons < 9.5 - Authenticated (Subscriber+) Local File Inclusion

Description The Easy Social Share Buttons for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary files on the...

CVE-2024-2327

The Global Elementor Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link URL in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2327 Global Elementor Buttons <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link

The Global Elementor Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link URL in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2327: Improper Neutralization of Input During Web Page Generation

The Global Elementor Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link URL in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2024-19764 · WordPress · Global Elementor Buttons

Name of the Vulnerable Software and Affected Versions: Global Elementor Buttons plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to Stored Cross-Site Scripting via the button link URL due to insufficient input sanitization and output escaping on...

WordPress Plugin Global Elementor Buttons 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-2501: Deserialization of Untrusted Data

The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.33.1 via deserialization of untrusted input via the 'dpspmaybeunserialize' function. This makes it possible for authenticated attackers, with...

WordPress Easy Social Share Buttons plugin <= 9.4 - Multiple Broken Access Control vulnerability

Multiple Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Easy Social Share Buttons versions = 9.4...

WordPress Easy Social Share Buttons plugin <= 9.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Easy Social Share Buttons versions = 9.4...

WordPress Global Elementor Buttons plugin <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link vulnerability

AuthenticatedContributor+ Stored Cross-Site Scripting via button link vulnerability discovered by Francesco Carlucci in WordPress Plugin Global Elementor Buttons versions = 1.1.0...

WordPress Global Elementor Buttons Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Global Elementor Buttons Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2327 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9b77cf7f4448 Credits Francesco Carlucc...

WordPress Easy Social Share Buttons Plugin <= 9.4 is vulnerable to Local File Inclusion

Software Easy Social Share Buttons Type Plugin Vulnerable versions = 9.4 Fixed in 9.5 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-31300 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 770673a69613 Credits Rafie Muhammad Patchstack Required...

WordPress Easy Social Share Buttons Plugin <= 9.4 is vulnerable to Broken Access Control

Software Easy Social Share Buttons Type Plugin Vulnerable versions = 9.4 Fixed in 9.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31307 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 88c85a953f3f Credits Rafie Muhammad...

Woocommerce Social Media Share Buttons <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting

Description The Woocommerce Social Media Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to...

CVE-2024-31109

CVE-2024-31109 describes a CSRF-driven stored XSS vulnerability in Toastie Studio Woocommerce Social Media Share Buttons (affecting builds up to 1.3.0). The Red Hat entry confirms CSRF as the vulnerability type and Stored XSS as the impact, affecting the specified plugin. The provided documents d...

CVE-2024-31109: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Toastie Studio Woocommerce Social Media Share Buttons allows Stored XSS.This issue affects Woocommerce Social Media Share Buttons: from n/a through 1.3.0...

PT-2024-23778 · Toastie Studio · Woocommerce Social Media Share Buttons

Name of the Vulnerable Software and Affected Versions: Woocommerce Social Media Share Buttons versions 1.3.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Toastie Studio Woocommerce Social Media Share Buttons. Recommendations: For...

WordPress Plugin Woocommerce Social Media Share Buttons 跨站请求伪造漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. WordPress Plugin Woocommerce Social Media Share Button...