PT-2024-24076 · Unknown · Stefano Lissa & The Newsletter Team Newsletter

Name of the Vulnerable Software and Affected Versions: Stefano Lissa & The Newsletter Team Newsletter versions n/a through 8.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

WordPress Newsletter plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Newsletter versions = 8.0.6...

WordPress Newsletter Plugin <= 8.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Newsletter Type Plugin Vulnerable versions = 8.0.6 Fixed in 8.0.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31434 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b4d0ee5b28fa Credits Dhabaleshwar Das Require...

ENL Newsletter <= 1.0.1 - Campaign Deletion via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack Make an admin open a URL like where is a valid ID: http://example.com/wp-admin/admin.php?page=enl-campaigns&action=campaign-delete&id=...

ENL Newsletter <= 1.0.1 - Admin+ SQL Injection

Description The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks As an admin open a link like:...

ENL Newsletter <= 1.0.1 - Admin+ SQL Injection

Description The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks PoC As an admin open a link like: http://example.com/wp-admin/admin.php?page=enl-campaigns=campaign-run=1%20AND%20SELECT%20%20FROM%20SELECTSLEEP5nQI...

ENL Newsletter <= 1.0.1 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make an admin open an HTML file containing: Name: alert1' / alert2' /...

Declassified NSA Newsletters

Through a 2010 FOIA request yes, it took that long, we have copies of the NSAs KRYPTOS Society Newsletter, "Tales of the Krypt," from 1994 to 2003. There are many interesting things in the 800 pages of newsletter. There are many redactions. And a 1994 review of Applied Cryptography by redacted:...

CVE-2024-31110

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Katz Web Services, Inc. Contact Form 7 Newsletter allows Reflected XSS.This issue affects Contact Form 7 Newsletter: from n/a through 2.2...

CVE-2024-31110 WordPress Contact Form 7 Newsletter plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Katz Web Services, Inc. Contact Form 7 Newsletter allows Reflected XSS.This issue affects Contact Form 7 Newsletter: from n/a through 2.2...

CVE-2024-31110

CVE-2024-31110 — Reflected XSS in Contact Form 7 Newsletter (WordPress plugin) via Katz Web Services, Katz Contact Form 7 Newsletter. The vulnerability is an improper input neutralization vulnerability that could affect from n/a through 2.2. CVSS v3.1 base score listed as 7.1 (HIGH). Connected Re...

WordPress Plugin Contact Form 7 Newsletter 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-30430

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Email Newsletter Team - FluentCRM Fluent CRM allows Stored XSS.This issue affects Fluent CRM: from n/a through 2.8.44...

CVE-2024-30430

CVE-2024-30430 is a stored XSS in the WP Email Newsletter Team (FluentCRM) for FluentCRM, with exploitation possible via input not properly neutralized during web page generation. Affected: FluentCRM up to version 2.8.44. Root cause per Red Hat/other sources is improper input handling leading to ...

WordPress Contact Form 7 Newsletter plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Contact Form 7 Newsletter versions = 2.2...

WordPress Contact Form 7 Newsletter Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 Newsletter Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31110 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d60fc2231b4d Credits Dimas Maulana Required...

WordPress Newsletter Plugin <= 8.2.0 is vulnerable to Bypass Vulnerability

Software Newsletter Type Plugin Vulnerable versions = 8.2.0 Fixed in 8.2.1 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-30522 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 3a2b06142955 Credits Mika Required privilege...

Jetpack < 13.2.1 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks When the "Let visitors subscribe...

CVE-2024-2392

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-2392

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...