WordPress plugin wp-login customizer 请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

WordPress wp-login customizer plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin wp-login customizer versions = 1.0...

CVE-2024-9848

The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2024-9848

CVE-2024-9848 affects the WordPress plugin Product Customizer Light (versions up to and including 1.0.0). The vulnerability is a Stored Cross-Site Scripting (XSS) via SVG file uploads caused by insufficient input sanitization and output escaping. Exploitation requires an authenticated attacker wi...

CVE-2024-9848 Product Customizer Light <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

WordPress plugin Product Customizer Light 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2024-49288

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through = 1.2.9.1...

CVE-2024-49288

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.2.5...

CVE-2024-49288 WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through = 1.2.9.1...

CVE-2024-49288

CVE-2024-49288 is a Stored XSS in the WordPress plugin Email Template Customizer for WooCommerce (VillaTheme). Affected versions are

CVE-2024-49288 WordPress Email Template Customizer for WooCommerce plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in VillaTheme Email Template Customizer for WooCommerce allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through 1.2.5...

WordPress Product Customizer Light plugin <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Product Customizer Light versions = 1.0.0...

WordPress Product Customizer Light Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Product Customizer Light Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9848 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID feb6f008a7e9 Credits Francesco Carlucc...

PT-2024-39885 · WordPress · Product Customizer Light

Name of the Vulnerable Software and Affected Versions: Product Customizer Light plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

WordPress plugin Email Template Customizer for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Email Template Customizer for WooCommerce versions = 1.2.9.1...

WordPress Email Template Customizer for WooCommerce Plugin <= 1.2.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Email Template Customizer for WooCommerce Type Plugin Vulnerable versions = 1.2.9.1 Fixed in 1.2.9.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49288 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d7ef4a819407 Credits savphill...

WordPress Customizer Export/Import plugin <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import vulnerability

Authenticated Admin+ Arbitrary File Upload via Customization Settings Import vulnerability discovered by Luk6785 in WordPress Plugin Customizer Export/Import versions = 0.9.7...

WordPress Customizer Export/Import Plugin <= 0.9.7 is vulnerable to Arbitrary File Upload

Software Customizer Export/Import Type Plugin Vulnerable versions = 0.9.7 Fixed in 0.9.7.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7620 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 9417048c628d Credits Luk6785 Required privilege...

CVE-2024-7620

The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to...