10687 matches found
CVE-2024-2831 Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode
The Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcodes in all versions up to, and including, 1.3.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2024-33950 WordPress Archives Calendar Widget plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability
Administrator Cross Site Scripting XSS in Archives Calendar Widget = 1.0.15 versions...
CVE-2024-33950
CVE-2024-33950 – Archives Calendar Widget (WordPress plugin) contains an authenticated Stored XSS vulnerability in versions
PT-2024-22387
Name of the Vulnerable Software and Affected Versions The Calendar plugin for WordPress versions up to, and including, 1.3.14 Description The issue arises from insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin's...
WordPress plugin Calendar 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
CVE-2024-2831: Improper Neutralization of Special Elements used in an SQL Command
The Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcodes in all versions up to, and including, 1.3.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
WordPress Calendar plugin <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode vulnerability
Authenticated Contributor+ SQL Injection via Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Calendar versions = 1.3.14...
WordPress Archives Calendar Widget plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Archives Calendar Widget versions = 1.0.15...
WordPress Archives Calendar Widget Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)
Software Archives Calendar Widget Type Plugin Vulnerable versions = 1.0.15 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33950 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5d201ab70e97 Credits Joshua Chan Required privilege...
WordPress Calendar Plugin <= 1.3.14 is vulnerable to SQL Injection
Software Calendar Type Plugin Vulnerable versions = 1.3.14 Fixed in 1.3.15 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2831 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 8a403f3f03cd Credits Krzysztof Zając Required privilege Contributor Publishe...
CVE-2024-33640
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LBell Pretty Google Calendar allows Stored XSS.This issue affects Pretty Google Calendar: from n/a through 1.7.2...
CVE-2024-33640 WordPress Pretty Google Calendar plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LBell Pretty Google Calendar allows Stored XSS.This issue affects Pretty Google Calendar: from n/a through 1.7.2...
CVE-2024-33640 WordPress Pretty Google Calendar plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LBell Pretty Google Calendar allows Stored XSS.This issue affects Pretty Google Calendar: from n/a through 1.7.2...
CVE-2024-33640
CVE-2024-33640 is a stored XSS in the Pretty Google Calendar WordPress plugin (LBell Pretty Google Calendar) affecting versions up to 1.7.2. Root cause: improper neutralization of user input during web page generation, enabling stored cross-site scripting. Impact per CVSS: low confidentiality, in...
Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode
Description The Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcodes in all versions up to, and including, 1.3.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...
WordPress plugin Pretty Google Calendar 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...
CVE-2024-33640: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LBell Pretty Google Calendar allows Stored XSS.This issue affects Pretty Google Calendar: from n/a through 1.7.2...
PT-2024-25401
Name of the Vulnerable Software and Affected Versions Pretty Google Calendar versions n/a through 1.7.2 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations For...
