WordPress Login with phone number plugin <= 1.3.6 - Unauthenticated Remote Plugin Deletion vulnerability

Unauthenticated Remote Plugin Deletion vulnerability discovered by Michal Lipinski in WordPress Login with phone number plugin versions = 1.3.6. Solution Update the WordPress Login with phone number plugin to the latest available version at least 1.3.7...

WordPress Relevanssi Premium plugin <= 2.16.4 - Unauthorized AJAX Calls vulnerability

Unauthorized AJAX Calls vulnerability discovered by Jan w Oleju in WordPress Relevanssi Premium plugin versions = 2.16.4. Solution Update the WordPress Relevanssi Premium plugin to the latest available version at least 2.16.5...

WordPress Classic Editor Addon plugin <= 2.6.3 - Arbitrary Plugin Activation vulnerability

Arbitrary Plugin Activation vulnerability discovered by Jan w Oleju in WordPress Classic Editor Addon plugin versions = 2.6.3. Solution Update the WordPress Classic Editor Addon plugin to the latest available version at least 2.6.4...

WordPress WP Ultimate CSV Importer plugin <= 6.4.1 - Arbitrary Option Deletion vulnerability

Arbitrary Option Deletion vulnerability discovered by WPScanTeam in WordPress WP Ultimate CSV Importer plugin versions = 6.4.1. Solution Update the WordPress WP Ultimate CSV Importer plugin to the latest available version at least 6.4.2...

WordPress Futurio Extra plugin <= 1.6.2 - User Email Address Leakage vulnerability

User Email Address Leakage vulnerability discovered by Krzysztof Zając in WordPress Futurio Extra plugin versions = 1.6.2. Solution Update the WordPress Futurio Extra plugin to the latest available version at least 1.6.3...

Jimoty App for Android uses a hard-coded API key for an external service

Overview Jimoty App for Android provided by Jimoty, Inc. uses a hard-coded API key for an external service CWE-798. Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact API key for...

WordPress Ivory Search plugin <= 5.4 - Multiple Stored Cross-Site Scripting (XSS) vulnerability

Multiple Stored Cross-Site Scripting XSS vulnerabilities discovered by Yoru Oni in WordPress Ivory Search plugin versions = 5.4. Solution Update the WordPress Ivory Search plugin to the latest available version at least 5.4.1...

WordPress 4.9.x < 4.9.19 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS vulnerability through post slugs. - An object injection vulnerability in some multisite installations. - A SQL injection vulnerability in...

PT-2021-23389 · Faust +1 · Faust +1

Name of the Vulnerable Software and Affected Versions: Faust version 2.23.1 Description: The issue arises when an input file contains specific lines, including "// r visualisation tCst", "//process = +: L: abM-^Q;", and "process = route3333333333333333333,2,1,2,3,1 : ;", leading to stack...

WordPress Link Library plugin <= 7.2.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Link Library plugin versions = 7.2.8. Solution Update the WordPress Link Library plugin to the latest available version at least 7.2.9...

WordPress Protect WP Admin plugin <= 3.6 - Unauthenticated Plugin Deactivation vulnerability

Unauthenticated Plugin Deactivation vulnerability discovered by Krzysztof Zając in WordPress Protect WP Admin plugin versions = 3.6. Solution Update the WordPress Protect WP Admin plugin to the latest available version at least 3.6.2...

Vulnerabilities in SICK SOPAS ET

SICK received a report from Eden Bar of Claroty about multiple security vulnerabilities in the SICK SOPAS ET software. An unauthorized attacker could potentially craft a malicious SOPAS Device Driver SDD file, that if a user imports that file to SOPAS ET could allow arbitrary code execution on th...

WordPress Out-of-the-Box premium plugin <= 1.20.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Trainer Red in WordPress Out-of-the-Box premium plugin versions = 1.20.2. Solution Update the WordPress Out-of-the-Box premium plugin to the latest available version at least 1.20.3...

WordPress Share-one-Drive premium plugin <= 1.15.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Trainer Red in WordPress Share-one-Drive premium plugin versions = 1.15.2. Solution Update the WordPress Share-one-Drive premium plugin to the latest available version at least 1.15.3...

Multiple vulnerabilities in Trend Micro Security 2021 family (Consumer)

Overview Trend Micro Incorporated has released security updates for Trend Micro Security 2021 family Consumer. Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN. Impact Maximum Security 2021 A user who can log in to the system where...

WordPress Browser and Operating System Finder plugin <= 1.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Imai Shinpei Cryptography Laboratory Tokyo Denki University in WordPress Browser and Operating System Finder plugin versions = 1.1. Solution Update the WordPress Browser and Operating System Finder plugin to the latest available version ...

WordPress Event Manager for WooCommerce plugin <= 3.5.1 - Unauthenticated Arbitrary Elementor Template Import vulnerability

Unauthenticated Arbitrary Elementor Template Import vulnerability discovered by WPScanTeam in WordPress Event Manager for WooCommerce plugin versions = 3.5.1. Solution Update the WordPress Event Manager for WooCommerce plugin to the latest available version at least 3.5.3...

WordPress WP DSGVO Tools (GDPR) plugin <= 3.1.22 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Ramuel Gall WordFence in WordPress WP DSGVO Tools GDPR plugin versions = 3.1.22. Solution Update the WordPress WP DSGVO Tools GDPR plugin to the latest available version at least 3.1.24...

WordPress myCred plugin <= 2.2 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by bl4derunner in WordPress myCred plugin versions = 2.2. Solution Update the WordPress myCred plugin to the latest available version at least 2.3...

WordPress Logo Showcase with Slick Slider plugin <= 1.2.4 - Arbitrary Media Title/Description/Alt Text/URL Update vulnerability

Arbitrary Media Title/Description/Alt Text/URL Update vulnerability discovered by apple502j in WordPress Logo Showcase with Slick Slider plugin versions = 1.2.4. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 1.2.5...