CVE-2024-13340

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdfresultsbyajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-13340 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdfresultsbyajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-13340 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdfresultsbyajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

WordPress plugin metadata and taxonomies: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2024-13340: Improper Neutralization of Input During Web Page Generation

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdfresultsbyajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin MDTF versions = 1.3.3.6...

SUSE CVE-2024-47068

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta e.g., import.meta.url in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting...

fluent-bit:flb-it-fuzz-input_fuzzer_OSSFUZZ: Crash in cio_meta_read

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5796304898293760 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-inputfuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type: UNKNOWN READ Crash...

WordPress Post Meta plugin <= 1.0.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Post Meta versions = 1.0.9...

CVE-2024-9636 Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation

The Post Grid and Gutenberg Blocks plugin for WordPress is vulnerable to privilege escalation in versions 2.2.85 to 2.3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register...

PT-2025-3729 · WordPress · Post Grid/Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: Post Grid and Gutenberg Blocks plugin for WordPress versions 2.2.85 through 2.3.3 Description: The issue arises from the plugin not properly restricting what user meta can be updated during profile registration, making it possible for...

E.U. Commission Fined for Transferring User Data to Meta in Violation of Privacy Laws

The European General Court on Wednesday fined the European Commission, the primary executive arm of the European Union responsible for proposing and enforcing laws for member states, for violating the bloc's own data privacy regulations. The development marks the first time the Commission has bee...

CVE-2024-12030

MDTF – Meta Data and Taxonomies Filter (WordPress) is vulnerable to SQL Injection via the key parameter in the mdf_value shortcode in all versions up to and including 1.3.3.5. The vulnerability requires authentication (Contributor level or higher) and can be leveraged to append additional SQL to ...

CVE-2024-12030: Improper Neutralization of Special Elements used in an SQL Command

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-55218

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

CVE-2024-55218

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Thanh Nam Tran in WordPress Plugin MDTF versions = 1.3.3.5...

CVE-2024-55218: Improper Neutralization of Input During Web Page Generation

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter...

CVE-2024-12738: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping...

PT-2025-3101

Name of the Vulnerable Software and Affected Versions IceWarp Server version 10.2.1 Description The issue is related to Cross Site Scripting XSS and can be exploited via the meta parameter. This allows for malicious scripts to be injected into websites, potentially leading to unauthorized access ...