WordPress Easy Menu Manager plugin <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Easy Menu Manager versions = 1.0.1...

WordPress Easy Post Types Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Easy Post Types Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10080 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c5d62efaca31 Credits István Márton Required...

WordPress Easy Menu Manager Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy Menu Manager Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9366 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3e1b3771881c Credits Francesco Carlucci...

PT-2024-16011 · WordPress · Wp Easy Post Types

Name of the Vulnerable Software and Affected Versions: WP Easy Post Types plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to a missing capability check on multiple functions, which allows authenticated attackers with subscriber-level access and above to...

CVE-2024-9592

CVE-2024-9592 concerns the WordPress plugin Easy PayPal Gift Certificate (versions ≤ 1.2.3). The vulnerability is a Cross-Site Request Forgery that, due to missing/incorrect nonce validation in the wpppgc_plugin_options function, can allow an unauthenticated attacker to update plugin settings and...

CVE-2024-9595: Improper Neutralization of Input During Web Page Generation

The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-9592: Cross-Site Request Forgery (CSRF)

The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the 'wpppgcpluginoptions' function. This makes it possible for unauthenticated attackers to update the...

PT-2024-39709

Name of the Vulnerable Software and Affected Versions Easy PayPal Gift Certificate plugin for WordPress versions up to, and including, 1.2.3 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wpppgc plugin options function. This allo...

WordPress Easy PayPal Gift Certificate Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Easy PayPal Gift Certificate Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9592 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e85fe46e59dc Credits István...

CVE-2024-9782

A vulnerability was found in D-Link DIR-619L B1 2.06. It has been declared as critical. This vulnerability affects the function formEasySetupWWConfig of the file /goform/formEasySetupWWConfig. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely...

CVE-2024-8729

The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-8729

CVE-2024-8729 affects the WordPress plugin Easy Social Share Buttons (versions ≤ 1.4.5). It enables Reflected Cross-Site Scripting via add_query_arg without proper escaping, allowing unauthenticated attackers to inject scripts in pages executed when a user is tricked into clicking a link. Exploit...

CVE-2024-8729 Easy Social Share Buttons <= 1.4.5 - Reflected Cross-Site Scripting

The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-8729: Improper Neutralization of Input During Web Page Generation

The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to inject arbitrary web script...

WordPress Easy Social Share Buttons Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Easy Social Share Buttons Type Plugin Vulnerable versions = 1.4.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8729 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID db873cfad5a2 Credits vgo0...

alcali (>=2019.2.5, <=3000.1.0), deustest2022 (1.0.0) +6 more potentially affected by CVE-2024-45231 via django (3.0.5)

django PYPI version 3.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2019.2.5, =0.2.32, =1.1.0, =8.2.0, =0.2.2, =0.9.9, =0.10.0 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

django-easy-login (>=0.1.0.dev0, <=0.1.0.dev2), nemo (>=1.14.2, <=1.14.3) potentially affected by CVE-2024-45231 via django (1.11.22)

django PYPI version 1.11.22 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-easy-login =0.1.0.dev0, =1.14.2, =1.14.3 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

CVE-2024-8433

The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunkmegamenubgimage' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-8433 Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunkmegamenubgimage' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-39010 · Themehunk · Easy Mega Menu Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This...