CVE-2024-9274

The Elastik Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9108

The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convertremoteimagetolocal' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2024-9119

The SVG Complete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2024-9304

CVE-2024-9304 affects the WordPress LocateAndFilter plugin up to and including version 1.6.14, allowing Stored Cross-Site Scripting via SVG file uploads by authenticated users with Author-level access or higher. Connected sources confirm the vulnerability and targeted component (LocateAndFilter) ...

CVE-2024-9274

The CVE CVE-2024-9274 affects Elastik Page Builder for WordPress, with Stored Cross-Site Scripting via SVG file uploads in all versions up to 0.27.4 due to insufficient input sanitization and output escaping. Exploitation requires Author-level access or higher, and injected scripts run when a use...

CVE-2024-9108

The CVE-2024-9108 entry concerns the WordPress plugin Wechat Social login (WeChat) for WordPress. Connected sources confirm the vulnerability exists in versions up to 1.3.0, enabling unauthenticated arbitrary file uploads via convert_remoteimage_to_local, with potential remote code execution. No ...

CVE-2024-8107

The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

PT-2024-38632 · WordPress · Wp Hotel Booking

Name of the Vulnerable Software and Affected Versions: WP Hotel Booking plugin for WordPress versions up to, and including, 2.1.2 Description: The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update review function. This...

WordPress plugin LocateAndFilter 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-47169 Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those...

CVE-2024-8126

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'classfmaconnector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an...

CVE-2024-8126

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'classfmaconnector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an...

CVE-2024-8126

CVE-2024-8126 affects the WordPress plugin Advanced File Manager (versions up to and including 5.2.8). The connected sources confirm an authenticated arbitrary file upload vulnerability via the file class_fma_connector.php that can allow a Subscriber+ attacker (with Administrator-granted permissi...

CVE-2024-9117

The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-9115

The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9173

The CVE-2024-9173 entry concerns GF Custom Style for WordPress (v

CVE-2024-7772

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

CVE-2024-7772

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

CVE-2024-7772

The Jupiter X Core WordPress plugin (Jupiter X Core) is affected by CVE-2024-7772: an unauthenticated arbitrary file upload vulnerability caused by mishandled file type validation in the validate function, impacting all versions up to and including 4.6.5. Exploitation can allow uploading arbitrar...

CVE-2024-9069

The Graphicsly – The ultimate graphics plugin for WordPress website builder Gutenberg, Elementor, Beaver Builder, WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and...