Float menu < 6.0.1 - Menu Deletion via CSRF

Description The plugin does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack. PoC Make a logged in admin open one a page with the code below, this will make them delete the menu with ID 1:...

Side Menu Lite < 4.2.1 - Menu Deletion via CSRF

Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks Make a logged in admin open an HTML file where ID is a valid ID: action...

PT-2024-21376 · WordPress · My Sticky Bar

Name of the Vulnerable Software and Affected Versions: The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin versions prior to 2.6.8 Description: The issue concerns a Stored Cross-Site Scripting attack that can be performed by...

CVE-2024-30866

netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/menu.php...

NetentSec NS-ASG security vulnerability

NetentSec NS-ASG is an application security gateway from China NetentSec. A security vulnerability exists in NetentSec NS-ASG version 6.3, which originates from an SQL injection vulnerability in the /3g/menu.php file...

PT-2024-23644 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection. It can be exploited via the "/3g/menu.php" API endpoint. Recommendations: For netentsec NS-ASG version 6.3, consider restricting access to the "/3g/menu.php"...

CVE-2024-28003

Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3...

CVE-2024-28003 WordPress Max Mega Menu plugin <= 3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3...

CVE-2024-28003

CVE-2024-28003 affects the WordPress plugin Max Mega Menu (Max Mega Menu) up to version 3.3 (inclusive). Root cause: missing authorization check in the sandbox() function enables “broken access control,” allowing unauthorised or limited-privilege actions by authenticated users (e.g., subscriber l...

WordPress Plugin Max Mega Menu has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-28003: Missing Authorization

Missing Authorization vulnerability in Megamenu Max Mega Menu.This issue affects Max Mega Menu: from n/a through 3.3...

PT-2024-22942

Name of the Vulnerable Software and Affected Versions The Networker - Tech News WordPress Theme with Dark Mode theme for WordPress versions up to, and including, 1.1.9 Description The issue is related to a missing capability check on the admin reload nav menu function, which allows unauthenticate...

PT-2024-22199

Name of the Vulnerable Software and Affected Versions Max Mega Menu versions 3.3 and earlier Description The issue is related to a Missing Authorization vulnerability in Max Mega Menu. This vulnerability affects Max Mega Menu versions from the start through 3.3. Recommendations For Max Mega Menu...

WordPress Theme Networker security vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on servers running PHP and MySQL.WordPress theme is a theme for WordPress. A security vulnerability exists in WordPress Theme Networker 1.1.9 and earlier versions, which stems...

WordPress Max Mega Menu Plugin <= 3.3 is vulnerable to Broken Access Control

Software Max Mega Menu Type Plugin Vulnerable versions = 3.3 Fixed in 3.3.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-28003 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3ddcba15780a Credits Rafie Muhammad Patchstack Require...

Super Page Cache for Cloudflare < 4.7.6 - Cross-Site Request Forgery

Description The Super Page Cache for Cloudflare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7.5. This is due to missing or incorrect nonce validation on the adminmenupageindex function. This makes it possible for unauthenticated attackers t...

CVE-2024-29089 WordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Five Star Plugins Five Star Restaurant Menu allows Stored XSS.This issue affects Five Star Restaurant Menu: from n/a through 2.4.14...

CVE-2024-29089

CVE-2024-29089 is a Stored XSS vulnerability in Five Star Restaurant Menu (WordPress plugin) affecting versions up through 2.4.14. The issue stems from improper input neutralization during web page generation, enabling stored cross-site scripting. The linked Red Hat/Wordfence entries confirm the ...

PT-2024-22709 · Unknown · Five Star Restaurant Menu

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Menu versions through 2.4.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS, which can be exploited by...

WordPress Plugin Restaurant Menu and Food Ordering Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...