WordPress plugin Element Pack Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Element Pack Elementor Addons < 5.6.4 - Form Submission Admin Email Bypass

Description The plugin is vulnerable to Form Submission Admin Email Bypass due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form...

CVE-2024-3268

The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the emdformbuilderlitesubmitform function in all versions up to, and including, 3.3.6. This makes it...

CVE-2024-32512 WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability

Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20...

CVE-2024-32512 WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability

Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20...

CVE-2024-0710

CVE-2024-0710 – GP Unique ID (WordPress) : Unauthenticated attackers can modify the generated Unique ID due to insufficient input validation in GP Unique ID plugin versions up to 1.5.5, risking integrity where ID uniqueness matters. CVSS v3.1 base score 5.3 (Medium). Remediation: upgrade to 1.5.6...

WordPress Plugin GP Unique ID 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-6717

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...

GP Unique ID < 1.5.6 - Unauthenticated Form Submission Unique ID Modification

Description The plugin is vulnerable to Unique ID Modification due to insufficient input validation. This makes it possible for unauthenticated attackers to tamper with the generation of a unique ID on a form submission and replace the generated unique ID with a user-controlled one, leading to a...

Ninja Forms Contact Form < 3.8.1 - Publicly Accessible Form Submission Export via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery This is due to missing or incorrect nonce validation on the nfdownloadallsubs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a...

PT-2024-18188 · Bit Form · Contact Form Builder Plugin

Name of the Vulnerable Software and Affected Versions: The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress versions up to, and including, 2.10.1 Description: The issue is related to insufficient user validation on the...

CVE-2023-42307

Cross Site Scripting XSS vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" and "Subject Code" section...

CVE-2023-42307

Cross Site Scripting XSS vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" and "Subject Code" section...

Cross site scripting

Cross Site Scripting XSS vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" and "Subject Code" section...

Exam Form Submission Cross-Site Scripting Vulnerability

Code-Projects Exam Form Submission is an open source exam form from Code-Projects. A cross-site scripting vulnerability exists in Exam Form Submission version 1.0 that originates from allowing an attacker to execute arbitrary code via Subject Name and Subject Code...

CVE-2023-42307

The CVE-2023-42307 entry concerns a Cross Site Scripting (XSS) vulnerability in the Code-Projects Exam Form Submission 1.0. The issue allows an attacker to execute arbitrary code via inputs in the Subject Name and Subject Code fields. Public references in the connected documents consistently desc...

CVE-2023-42307

Cross Site Scripting XSS vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" and "Subject Code" section...

Exam Form Submission Cross-Site Scripting Vulnerability

Code-Projects Exam Form Submission is a Code-Projects open source exam form. A cross-site scripting vulnerability exists in Exam Form Submission version 1.0, which stems from a cross-site scripting vulnerability in Manage Fastrack Subjects that allows an attacker to execute arbitrary code via...

CVE-2023-42308

CVE-2023-42308 is an XSS vulnerability affecting Code-Projects Exam Form Submission version 1.0, specifically in the Manage Fastrack Subjects feature. The root cause involves untrusted input in the Subject Name and Subject Code fields, enabling cross-site script execution. Public documents from R...

Ultimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Have an admin open an HTML file containing the following: document.forms0.submit;...