173 matches found
WordPress plugin The Post Grid security vulnerability
WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-18037 · Unknown · The Post Grid – Shortcode
Name of the Vulnerable Software and Affected Versions: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin versions up to, and including, 7.7.1 Description: The issue is related to Stored Cross-Site Scripting via the section title tag attribute due to insufficient...
CVE-2024-4043
CVE-2024-4043 pertains to the WordPress plugin WP Ultimate Post Grid . The issue is a Stored Cross-Site Scripting (XSS) in the plugin’s 'wpupg-text' shortcode , affecting all versions up to and including 3.9.1. The root cause is insufficient input sanitization and output escaping on user-supplied...
CVE-2024-3239
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Si...
WordPress The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin <= 7.6.1 - Missing Authorization vulnerability
Missing Authorization vulnerability discovered by Pavel Palii in WordPress Plugin The Post Grid versions = 7.6.1...
WordPress The Post Grid Plugin <= 7.6.1 is vulnerable to Broken Access Control
Software The Post Grid Type Plugin Vulnerable versions = 7.6.1 Fixed in 7.7.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3936 Patch priority Low CVSS severity Low 4.3 Developer Mamunur Rashid PSID ba4fe441d17b Credits Pavel Palii Required privilege...
WordPress Essential Grid Plugin <= 3.1.1 is vulnerable to Broken Access Control
Software Essential Grid Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3235 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 597aadc22d06 Credits 1337Wannabe Required privilege...
WordPress Responsive Gallery Grid Plugin < 2.3.11 is vulnerable to Cross Site Scripting (XSS)
Software Responsive Gallery Grid Type Plugin Vulnerable versions 2.3.11 Fixed in 2.3.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1664 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 64e1e4491d20 Credits WPScan Required...
Post Grid < 2.2.76 - Reflected Cross-Site Scripting
Description The Post Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.2.74 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...
Post Grid, Slider & Carousel Ultimate < 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description The Post Grid, Slider & Carousel Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
Deserialization of untrusted data
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of untrusted input in the outpostshortcodemetaboxmarkup function. This makes it...
CVE-2023-40211 WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50...
Essential Grid < 3.1.1 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-47684
Unauth. Reflected Cross-Site Scripting XSS vulnerability in ThemePunch OHG Essential Grid plugin = 3.1.0 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in ThemePunch OHG Essential Grid plugin = 3.1.0 versions...
WordPress Essential Grid Plugin <= 3.0.18 is vulnerable to Broken Access Control
Software Essential Grid Type Plugin Vulnerable versions = 3.0.18 Fixed in 3.0.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47771 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 7ac8b383b58b Credits Rafie Muhammad Patchstack...
CVE-2023-47684
CVE-2023-47684 is an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability in the ThemePunch OHG Essential Grid plugin for WordPress, affecting versions
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in G5Theme Grid Plus – Unlimited grid plugin = 1.3.2 versions...
CVE-2023-46209 WordPress Grid Plus Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in G5Theme Grid Plus – Unlimited grid plugin = 1.3.2 versions...