WordPress Improved Sale Badges – Free Version Plugin <= 1.0.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Improved Sale Badges – Free Version versions = 1.0.1...

CVE-2024-49593

In Advanced Custom Fields ACF before 6.3.9 and Secure Custom Fields before 6.3.6.3 plugins for WordPress, using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the fr...

Malicious code in updated-tricks-v-bucks-generator-free_2023-z5of (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-unq7ricsd (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-to62wfme (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-sdsk5 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-pi7x1s (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-lsrgt2 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-j5675 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-h4543 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-gfv5g (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-gf5g (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-dfg5 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-ca4j (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-7szc38qtb (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-6mlymerf (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in updated-tricks-v-bucks-generator-free_2023-6mlymadr (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in new-tricks-v-bucks-generator-free_2023-sure-ahk (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-6158

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evoeventpostupdatemeta function in all versions up to, and including, 4.5.4 for Pro and 2.2.7 for free. This make...

EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to the EventON Lite setting...