PT-2025-1689

Name of the Vulnerable Software and Affected Versions Solar Wizard Lite plugin for WordPress versions 1.2.4 and earlier Description The issue is related to Stored Cross-Site Scripting via the plugin's 'solar wizard' shortcode due to insufficient input sanitization and output escaping on...

WordPress plugin Chic Lite 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

WordPress Ajax Search Lite plugin < 4.12.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ajax Search Lite versions 4.12.4...

CVE-2024-10480

The 3DPrint Lite WordPress plugin, in versions prior to 2.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings, which could allow an attacker to force a logged-in administrator to modify those settings unknowingly. ...

PT-2024-16334

Name of the Vulnerable Software and Affected Versions Swift Performance Lite plugin for WordPress versions up to, and including, 2.3.7.1 Description The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the ajaxify function, enabling the execution of...

CVE-2024-11416

CVE-2024-11416 affects the WIP Incoming Lite WordPress plugin (versions

CVE-2024-10882 Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated...

WordPress Product Delivery Date for WooCommerce - Lite plugin <= 2.8.0 - Reflected Cross-Site Scripting vulnerability

WordPress Product Delivery Date for WooCommerce - Lite plugin = 2.8.0 - Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Product Delivery Date for WooCommerce – Lite versions = 2.8.0...

PT-2024-34852 · James Bruner · Wp Mmenu Lite

Name of the Vulnerable Software and Affected Versions: James Bruner WP MMenu Lite versions 1.0.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: Fo...

WordPress WS Form LITE Plugin <= 1.9.244 is vulnerable to Cross Site Scripting (XSS)

Software WS Form LITE Type Plugin Vulnerable versions = 1.9.244 Fixed in 1.9.245 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10647 Patch priority Medium CVSS severity Medium 7.1 Developer WS Form PSID fff125dfb47d Credits Peter Thaleikis Required...

WordPress WP MMenu Lite plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin WP MMenu Lite versions = 1.0.0...

CVE-2024-9345

The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject...

WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Product Delivery Date for WooCommerce – Lite versions = 2.7.3...

CVE-2024-9117

The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-9117 Mapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

WordPress plugin Joy Of Text Lite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin The Plus Addons for Elementor Page Builder Lite 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress plugin The Plus...

CVE-2024-37211 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ali2Woo Team Ali2Woo Lite allows Reflected XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5...

CVE-2024-2381

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxsaveimage function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level acces...

Wordpress Slideshow Gallery LITE plugin <= 1.8.1 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin Left right image slideshow gallery versions = 1.8.1...