CVE-2024-33641

Deserialization of Untrusted Data vulnerability in Team Yoast Custom field finder.This issue affects Custom field finder: from n/a through 0.3...

CVE-2024-33641

CVE-2024-33641 is an authenticated PHP object injection vulnerability in the WordPress plugin “Custom field finder” (affected from n/a up to and including 0.3). Exploitation requires authentication and leads to deserialization of untrusted data, with CVSS v3.1 base score 5.4 (Medium). Public refe...

WordPress plugin Custom field finder 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2024-25402 · Yoast · Team Yoast Custom Field Finder

Name of the Vulnerable Software and Affected Versions: Team Yoast Custom field finder versions 0.3 and earlier Description: The issue is related to Deserialization of Untrusted Data, which can lead to potential security risks. Recommendations: For versions 0.3 and earlier, update to a version tha...

WordPress Custom field finder plugin <= 0.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin Custom field finder versions = 0.3...

WordPress Custom field finder Plugin <= 0.3 is vulnerable to PHP Object Injection

Software Custom field finder Type Plugin Vulnerable versions = 0.3 Fixed in 0.4 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-33641 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 73f25d40c87c Credits CatFather Required privilege Author...

CVE-2024-1204 Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure

The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts...

PT-2024-22818 · Unknown · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms versions prior to 3.8.1 Description: The issue is related to a cross-site scripting vulnerability in custom fields for labels. If exploited, an arbitrary script may be executed on the web browser of the user accessing the website...

CVE-2024-31091

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SparkWeb Interactive, Inc. Custom Field Bulk Editor allows Reflected XSS.This issue affects Custom Field Bulk Editor: from n/a through 1.9.1...

CVE-2024-31091 WordPress Custom Field Bulk Editor plugin <= 1.9.1 - Cross Site Scripting vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SparkWeb Interactive, Inc. Custom Field Bulk Editor allows Reflected XSS.This issue affects Custom Field Bulk Editor: from n/a through 1.9.1...

CVE-2024-31091

CVE-2024-31091 is a reflected XSS in the WordPress plugin Custom Field Bulk Editor by SparkWeb Interactive, affecting versions from n/a through 1.9.1. The provided sources do not include a confirmed patch or mitigation details.

PT-2024-23759 · Unknown · Custom Field Bulk Editor

Name of the Vulnerable Software and Affected Versions: Custom Field Bulk Editor versions 1.9.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in the Custom Field Bulk...

WordPress Plugin Custom Field Bulk Editor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Custom Field Bulk Editor A...

WordPress Custom Field Bulk Editor plugin <= 1.9.1 - Cross Site Scripting vulnerability

Cross Site Scripting vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Custom Field Bulk Editor versions = 1.9.1...

WordPress Custom Field Bulk Editor Plugin <= 1.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field Bulk Editor Type Plugin Vulnerable versions = 1.9.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31091 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c632d030391c Credits Dimas Maulana Required...

Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure

Description The plugin does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts. 1. ADMIN: Install Meta Box 2. ADMIN: Add Meta Box fields through code or the premium add-on...

Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure

Description The plugin does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts. PoC 1. ADMIN: Install Meta Box 2. ADMIN: Add Meta Box fields through code or the premium add-on...

CVE-2024-25919

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6...

CVE-2024-25919 WordPress Custom Field Template plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6...

CVE-2024-25919

CVE-2024-25919 affects the WordPress plugin Custom Field Template (versions up to and including 2.6). The issue is a Stored XSS flaw in the $search_label handling, resulting from improper input sanitization/output escaping. Exploitation could allow an authenticated attacker (Contributor level) to...