PT-2024-39885 · WordPress · Product Customizer Light

Name of the Vulnerable Software and Affected Versions: Product Customizer Light plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

WordPress plugin Email Template Customizer for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Email Template Customizer for WooCommerce versions = 1.2.9.1...

WordPress Email Template Customizer for WooCommerce Plugin <= 1.2.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Email Template Customizer for WooCommerce Type Plugin Vulnerable versions = 1.2.9.1 Fixed in 1.2.9.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49288 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d7ef4a819407 Credits savphill...

WordPress Customizer Export/Import plugin <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import vulnerability

Authenticated Admin+ Arbitrary File Upload via Customization Settings Import vulnerability discovered by Luk6785 in WordPress Plugin Customizer Export/Import versions = 0.9.7...

WordPress Customizer Export/Import Plugin <= 0.9.7 is vulnerable to Arbitrary File Upload

Software Customizer Export/Import Type Plugin Vulnerable versions = 0.9.7 Fixed in 0.9.7.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7620 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 9417048c628d Credits Luk6785 Required privilege...

CVE-2024-7620

The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2024-7620 Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import

The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2024-7620

The CVE-2024-7620 entry concerns the WordPress plugin Customizer Export/Import (

CVE-2024-7620 Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import

The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

WordPress plugin Customizer Export/Import 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2024-38457 · WordPress · Customizer Export/Import

Name of the Vulnerable Software and Affected Versions: Customizer Export/Import plugin for WordPress versions up to, and including, 0.9.7 Description: The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import...

CVE-2024-6554 Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure

The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18. This is due the plugin utilizing composer without preventing direct access to the files. This makes it possible for...

CVE-2024-3249

CVE-2024-3249: The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized data modification due to missing capability checks on import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings in all versions up to 1.6.2. Authenticated a...

CVE-2024-3249 Zita Elementor Site Library <= 1.6.2 - Missing Authorization to Page Creation and Options Modification

The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importxmldata, xmldataimport, importoptiondata, importwidgets, and importcustomizersettings functions in all versions up to, and including, 1.6.2. This...

CVE-2024-32781 WordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for WooCommerce: from n/a through 2.6.0...

CVE-2024-32781

Technical details about CVE-2024-32781 (affected product, root cause, impact, or fix) are not provided in the supplied documents. Monitor for updates from vulnerability trackers and vendor advisories.

CVE-2024-32781 WordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeHigh Email Customizer for WooCommerce.This issue affects Email Customizer for WooCommerce: from n/a through 2.6.0...

WordPress plugin Email Customizer for WooCommerce 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

PT-2024-24853 · Woocommerce · Email Customizer For Woocommerce

Name of the Vulnerable Software and Affected Versions: Email Customizer for WooCommerce versions n/a through 2.6.0 Description: The issue is related to Exposure of Sensitive Information to an Unauthorized Actor, affecting Email Customizer for WooCommerce. Recommendations: For versions n/a through...