CVE-2024-8126

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'classfmaconnector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an...

CVE-2024-8126

The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads via the 'classfmaconnector.php' file in all versions up to, and including, 5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an...

CVE-2024-8126

CVE-2024-8126 affects the WordPress plugin Advanced File Manager (versions up to and including 5.2.8). The connected sources confirm an authenticated arbitrary file upload vulnerability via the file class_fma_connector.php that can allow a Subscriber+ attacker (with Administrator-granted permissi...

CVE-2024-9117

The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-9115

The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9173

The CVE-2024-9173 entry concerns GF Custom Style for WordPress (v

CVE-2024-7772

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

CVE-2024-7772

The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the 'validate' function in all versions up to, and including, 4.6.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

CVE-2024-7772

The Jupiter X Core WordPress plugin (Jupiter X Core) is affected by CVE-2024-7772: an unauthenticated arbitrary file upload vulnerability caused by mishandled file type validation in the validate function, impacting all versions up to and including 4.6.5. Exploitation can allow uploading arbitrar...

CVE-2024-9173: Improper Neutralization of Input During Web Page Generation

The GF Custom Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, ...

CVE-2024-9117: Improper Neutralization of Input During Web Page Generation

The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-9115: Improper Neutralization of Input During Web Page Generation

The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9125: Improper Neutralization of Input During Web Page Generation

The kingIE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject...

CVE-2024-9069

The Graphicsly – The ultimate graphics plugin for WordPress website builder Gutenberg, Elementor, Beaver Builder, WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and...

CVE-2024-9073

CVE-2024-9073 affects GutenGeek Free Gutenberg Blocks for WordPress (WordPress plugin). The vulnerability is Stored Cross-Site Scripting via SVG file uploads caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at Author level or higher, and th...

CVE-2024-9069

CVE-2024-9069 affects the WordPress plugin Graphicsly (Graphicsly – The ultimate graphics plugin for WordPress website builder) where a Stored Cross-Site Scripting (XSS) vulnerability exists via SVG file uploads in all versions up to and including 1.0.2. The issue stems from insufficient input sa...

CVE-2024-8917

The AnWP Football Leagues plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.16.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access an...

CVE-2024-9068: Improper Neutralization of Input During Web Page Generation

The OneElements – Best Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-9069: Improper Neutralization of Input During Web Page Generation

The Graphicsly – The ultimate graphics plugin for WordPress website builder Gutenberg, Elementor, Beaver Builder, WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and...

CVE-2024-9073: Improper Neutralization of Input During Web Page Generation

The GutenGeek Free Gutenberg Blocks for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...