CVE-2023-7154

The Hubbub Lite WordPress plugin (before 1.32.0) does not sanitize/escape certain settings, enabling Stored XSS by high-privilege admins even when unfiltered_html is disallowed (e.g., multisite). Versions prior to 1.32.0 are affected; remediation is to upgrade to 1.32.0 or later. Exploit evidence...

CVE-2023-7154 Hubbub Lite < 1.32.0 - Admin+ Stored XSS

The Hubbub Lite formerly Grow Social WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

PT-2024-15216 · WordPress · The Hubbub Lite

Name of the Vulnerable Software and Affected Versions: The Hubbub Lite formerly Grow Social WordPress plugin versions prior to 1.32.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is...

WordPress plugin Hubbub Lite security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

Ajax Search Lite < 4.11.5 - Reflected Cross-Site Scripting

Description The plugin is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.11.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a us...

Envira Gallery Lite < 1.8.7.3 - Missing Authorization to Gallery Modification via envira_gallery_insert_images

Description The plugin is vulnerable to unauthorized modification of data due to an improper capability check on the 'enviragalleryinsertimages' function in all versions up to, and including, 1.8.7.1. This makes it possible for authenticated attackers, with contributor access and above, to modify...

Hubbub Lite < 1.32.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup As admin, enable the 'Floating Sidebar...

ElementsKit Lite < 3.0.4 - Unauthenticated Sensitive Information Exposure

Description The plugin is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.3 via the ekitwidgetareacontent function. This makes it possible for unauthenticated attackers to obtain contents of posts in draft, private or pending review status that should not be...

CVE-2023-50612

Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter...

Design/Logic Flaw

Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter...

CVE-2023-50612

Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter...

CVE-2023-50612

Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter...

CVE-2023-50612

The CVE-2023-50612 issue affects fit2cloud Cloud Explorer Lite 1.4.1. It stems from an Insecure Permissions flaw in the cloud accounts parameter, enabling local attackers to escalate privileges and access sensitive information. Documents from Red Hat, NVD, OSV, and PT-Security corroborate the loc...

fit2cloud Cloud Explorer Lite Security Vulnerability

fit2cloud Cloud Explorer Lite is an open source lightweight cloud management platform. A security vulnerability exists in fit2cloud Cloud Explorer Lite version 1.4.1. A local attacker exploited the vulnerability to elevate privileges and obtain sensitive information via the cloud accounts paramet...

PT-2024-13947 · Fit2Cloud · Fit2Cloud Cloud Explorer Lite

Name of the Vulnerable Software and Affected Versions: fit2cloud Cloud Explorer Lite version 1.4.1 Description: The issue allows local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter. This is due to an Insecure Permissions vulnerability...

WordPress Ajax Search Lite Plugin <= 4.11.4 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Search Lite Type Plugin Vulnerable versions = 4.11.4 Fixed in 4.11.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-21752 Patch priority Medium CVSS severity Medium 7.1 Developer WPdreams PSID feaa068d0729 Credits Le Ngoc Anh Required privilege...

CVE-2023-52135

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170...

CVE-2023-52135 WordPress WS Form LITE Plugin <= 1.9.170 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170...

CVE-2023-52135

The CVE-2023-52135 vulnerability affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress. It is an SQL Injection (Improper Neutralization of Special Elements used in an SQL Command) affecting WS Form LITE for WordPress versions up to 1.9.170. According to connected sources, exploita...

PT-2023-31928 · WordPress · Ws Form Lite

Name of the Vulnerable Software and Affected Versions: WS Form LITE – Drag & Drop Contact Form Builder for WordPress versions 1.9.170 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This...