CVE-2024-12414

CVE-2024-12414 affects Themify Store Locator for WordPress (versions up to 1.1.9). Root cause: missing/incorrect nonce validation in setting_page(), enabling Cross‑Site Request Forgery. Attack: unauthenticated attacker can induce an admin to perform forged requests to modify plugin settings. Impa...

CVE-2024-12414 Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery

The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the settingpage function. This makes it possible for unauthenticated attackers to modify the plugin's...

PT-2024-17585 · WordPress · Themify Store Locator

Name of the Vulnerable Software and Affected Versions: Themify Store Locator plugin for WordPress versions up to, and including, 1.1.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the setting page function. This allows...

WordPress plugin Themify Store Locator 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2024-12414: Cross-Site Request Forgery (CSRF)

The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the settingpage function. This makes it possible for unauthenticated attackers to modify the plugin's...

WordPress Themify Store Locator plugin <= 1.1.9 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Peter Thaleikis in WordPress Plugin Themify Store Locator versions = 1.1.9...

firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack...

CVE-2024-52501

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WebbyTemplate Office Locator office-locator.This issue affects Office Locator: from n/a through = 1.3.0...

CVE-2024-52501 WordPress Office Locator plugin <= 1.3.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WebbyTemplate Office Locator office-locator.This issue affects Office Locator: from n/a through = 1.3.0...

CVE-2024-52501

CVE-2024-52501 affects the WordPress Office Locator plugin (Office Locator) with improper control of filenames in Include/Require statements, i.e., a Local File Inclusion/ PHP Remote File Inclusion issue. Public details indicate impact on Office Locator versions from 1.0 up to 1.3.0, with vendor ...

CVE-2024-52501 WordPress Office Locator plugin <= 1.3.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in webbytemplate Office Locator.This issue affects Office Locator: from n/a through 1.3.0...

WordPress plugin Office Locator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-35342 · Webbytemplate · Webbytemplate Office Locator

Name of the Vulnerable Software and Affected Versions: webbytemplate Office Locator versions 1.3.0 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion'. This vulnerability affects the...

CVE-2024-52501: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WebbyTemplate Office Locator office-locator.This issue affects Office Locator: from n/a through = 1.3.0...

WordPress Office Locator plugin <= 1.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Office Locator versions = 1.3.0...

WordPress Office Locator Plugin <= 1.3.0 is vulnerable to Local File Inclusion

Software Office Locator Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-52501 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 8e661c5613c5 Credits João Pedro S Alcântara Kinorth...

CVE-2024-51920

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pierre Jégo Map Store Locator map-store-location allows DOM-Based XSS.This issue affects Map Store Locator: from n/a through = 1.2.1...

CVE-2024-51920

CVE-2024-51920 affects Map Store Locator (WordPress plugin) versions 1.2.1 and earlier. Root cause: improper input neutralization during web page generation, enabling DOM-Based XSS. Impact: DOM-based cross-site scripting as described; no exploitation details provided in the sources. Remediation: ...

CVE-2024-51920 WordPress Map Store Locator plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pierre Jégo Map Store Locator map-store-location allows DOM-Based XSS.This issue affects Map Store Locator: from n/a through = 1.2.1...

WordPress plugin Map Store Locator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...