WordPress House Manager plugin <= 1.0.8.4 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Bob Matyas in WordPress Plugin House Manager versions = 1.0.8.4...

CVE-2024-3973

The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress House Manager Plugin <= 1.0.8.4 is vulnerable to Cross Site Scripting (XSS)

Software House Manager Type Plugin Vulnerable versions = 1.0.8.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3973 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID cf2e1703476c Credits Bob Matyas Required...

PT-2024-38376

Name of the Vulnerable Software and Affected Versions Traffic Manager plugin for WordPress versions up to, and including, 1.4.5 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the page parameter of the UserWebStat AJAX...

PT-2024-37452

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.2.97 Description: The issue is related to Stored Cross-Site Scripting in the Download Manager plugin for WordPress. This occurs via the plugin's 'wpdm all packages'...

WordPress Zephyr Project Manager plugin < 3.3.99 - Editor+ stored XSS vulnerability

Editor+ stored XSS vulnerability discovered by Adrian Peña Barragan in WordPress Plugin Zephyr Project Manager versions 3.3.99...

PT-2024-37476 · WordPress · Pz Frontend Manager

Name of the Vulnerable Software and Affected Versions: PZ Frontend Manager WordPress plugin versions prior to 1.0.6 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF...

WordPress Team Manager plugin <= 2.1.12 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin Team Manager versions = 2.1.12...

VulnCheck KEV: CVE-2024-5889

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-37224 · WordPress · The Events Manager

Name of the Vulnerable Software and Affected Versions: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress versions up to, and including, 6.4.8 Description: The issue is related to Reflected Cross-Site Scripting via the country parameter due to insufficient input...

PT-2024-18821

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.89 Description The issue arises from an improper authorization check on the protectMediaLibrary function, allowing unauthenticated attackers to access password-protected...

WordPress Download Manager plugin <= 3.2.92 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Jack Taylor in WordPress Plugin Download Manager versions = 3.2.92...

CVE-2024-4001

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdmmodalloginform' shortcode in all versions up to, and including, 3.2.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4001

The CVE-2024-4001 entry concerns the Download Manager plugin for WordPress (affected versions

PT-2024-28759

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.93 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wpdm modal login form shortcode. This allows...

CVE-2024-4160 Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, and including, 3.2.90 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2024-29456

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.90 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wpdm-all-packages shortcode. This allows...

CVE-2024-3918

The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks...

WordPress plugin Pet Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress plugin Pet Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...