1027 matches found
WordPress Just Custom Fields Plugin <= 3.3.2 is vulnerable to Broken Access Control
Software Just Custom Fields Type Plugin Vulnerable versions = 3.3.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6167 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 899cda063365 Credits Francesco Carlucci Required...
PT-2024-37428 · WordPress · Just Custom Fields
Name of the Vulnerable Software and Affected Versions: The Just Custom Fields plugin for WordPress versions up to, and including, 3.3.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on several AJAX functions. This allows unauthenticat...
Advanced custom fields, 2.7.7, SQL Injection
Version: Old 2.8.2 / New 2.8.3 Update details: Improved sanitization/escaping of custom field values in v2.8.3 Update URL: https://www.tassos.gr/releases/advanced-custom-fields/advanced-custom-fields-2-8-3?format=htmlChangelog...
WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability discovered by Security audit in WordPress Plugin Advanced Custom Fields PRO versions 6.3.2...
WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability
Subscriber+ Broken Access Control vulnerability discovered by Security audit in WordPress Plugin Advanced Custom Fields PRO versions 6.3.2...
WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability
Contributor+ Broken Access Control vulnerability discovered by Security audit in WordPress Plugin Advanced Custom Fields PRO versions 6.3.2...
WordPress Advanced Custom Fields PRO Plugin < 6.3.2 is vulnerable to Broken Access Control
Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 6.3.2 Fixed in 6.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37249 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f318d317c2ed Credits Rafie Muhammad...
CVE-2024-4565
The Advanced Custom Fields ACF WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access...
CVE-2024-4565 Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
The Advanced Custom Fields ACF WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access...
WordPress plugin Advanced Custom Fields security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the WordPre...
PT-2024-31718 · WordPress · Advanced Custom Fields Pro
Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields ACF WordPress plugin versions prior to 6.3 Advanced Custom Fields Pro WordPress plugin versions prior to 6.3 Description: The issue allows displaying custom field values for any post via shortcode without checking for t...
CVE-2024-34762
Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2....
CVE-2024-34762 Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability
Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2....
CVE-2024-34762
CVE-2024-34762 affects the WordPress plugin Advanced Custom Fields Pro (WP ACF Pro). The issue is an improper limitation of pathnames to a restricted directory, enabling PHP Local File Inclusion. Public details indicate impact up to versions prior to 6.2.10 (with some sources noting an authentica...
CVE-2024-34762 Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability
Vulnerability discovered by executing a planned security audit. Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPENGINE INC Advanced Custom Fields PRO allows PHP Local File Inclusion.This issue affects Advanced Custom Fields PRO: from n/a before 6.2....
CVE-2024-34761 Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability
Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code 'Code Injection' vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10...
CVE-2024-34761
CVE-2024-34761 is a vulnerability in the WordPress plugin Advanced Custom Fields Pro (WP ACF Pro) where an improper control of code generation enables Code Injection. The issue affects versions up to 6.2.9 (n/a before 6.2.10 per sources) and can be exploited by an authenticated user with Contribu...
WordPress plugin Advanced Custom Fields PRO path traversal vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...
WordPress plugin Advanced Custom Fields PRO Code Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability previously...