PT-2024-24685 · WordPress · Postx – Gutenberg Blocks For Post Grid

Name of the Vulnerable Software and Affected Versions: PostX – Gutenberg Blocks for Post Grid versions through 4.0.1 Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS. Recommendations: F...

Oracle Database Server (Apr 2024 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory. - Vulnerability in the RDBMS Python component of Oracle Database Server. Supported versions that are affected are 21.3-21.13. Easily exploitab...

HT Mega < 2.5.0 - Contributor+ Stored XSS via Image Grid Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the Image Grid widget's attributes due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages th...

Otter Blocks < 2.6.10 - Contributor+ Stored XSS via titleTag

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Post Grid widget due to insufficient input sanitization and output escaping on user supplied attributes such as 'titleTag'. This makes it possible for authenticated attackers, with contributor-level access and...

WordPress PostX Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

Software PostX Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2024-32564 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 904b17651379 Credits CatFather Required privilege...

WordPress Advanced Post Block - Post Grid for WordPress block editor Plugin <= 1.13.4 is vulnerable to Broken Access Control

Software Advanced Post Block - Post Grid for WordPress block editor Type Plugin Vulnerable versions = 1.13.4 Fixed in 1.13.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0908 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

Xibo 安全漏洞

Xibo is a content management system open source by Xibo Digital Signage. A security vulnerability exists in Xibo CMS that stems from the ability to perform session hijacking via cross-site scripting XSS attacks in the header and session grid...

CVE-2024-0881

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to rea...

CVE-2024-0881 Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to rea...

WordPress Essential Grid plugin <= 3.1.1 - Unauthenticated Private Post Disclosure vulnerability

Unauthenticated Private Post Disclosure vulnerability discovered by 1337Wannabe in WordPress Plugin Essential Grid versions = 3.1.1...

Wordpress Responsive Gallery Grid plugin < 2.3.11 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by WPScan in WordPress Plugin Responsive Gallery Grid versions 2.3.11...

WordPress Responsive Gallery Grid Plugin < 2.3.11 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Gallery Grid Type Plugin Vulnerable versions 2.3.11 Fixed in 2.3.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1664 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 64e1e4491d20 Credits WPScan Required...

WordPress Essential Grid Plugin <= 3.1.1 is vulnerable to Broken Access Control

Software Essential Grid Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3235 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 597aadc22d06 Credits 1337Wannabe Required privilege...

CVE-2024-3235

CVE-2024-3235 affects the Essential Grid Gallery WordPress Plugin (WordPress plugin name: Essential Grid) with a Sensitive Information Exposure in the on_front_ajax_action() path. All versions up to 3.1.1 are vulnerable, allowing unauthenticated attackers to view private and password-protected po...

PT-2024-24526 · WordPress · Essential Grid Gallery

Name of the Vulnerable Software and Affected Versions: The Essential Grid Gallery WordPress Plugin versions up to, and including, 3.1.1 Description: The issue allows unauthenticated attackers to view private and password-protected posts that may contain sensitive information. This is possible due...

Wordpress Plugin Essential Grid 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-1664

The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-1664 Responsive Gallery Grid < 2.3.11 - Admin+ Stored XSS

The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...