CVE-2024-6555

CVE-2024-6555 affects the WP Popups – WordPress Popup builder plugin for WordPress (typically WP Popups Lite) up to version 2.2.0.1. The issue is a Full Path Disclosure caused by using mobiledetect without access restrictions, allowing unauthenticated attackers to retrieve server file paths. Expl...

CVE-2024-6555 WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure

The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to...

CVE-2024-6555 WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure

The WP Popups – WordPress Popup builder plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.0.1. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to...

WordPress Simple Popup plugin <= 4.4 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Simple Popup versions = 4.4...

WordPress Simple Popup Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)

Software Simple Popup Type Plugin Vulnerable versions = 4.4 Fixed in 4.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38689 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 05d8413969d2 Credits Cronus Required privilege Administrator...

CVE-2024-36423 GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/public-chatflows/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to...

Malicious code in oauth-connect-popup (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2780 Malicious code in oauth-connect-popup (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2493 Malicious code in hw-popup (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hw-popup (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress Popup box plugin <= 4.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Popup box versions = 4.5.1...

WordPress Popup box Plugin <= 4.5.1 is vulnerable to Broken Access Control

Software Popup box Type Plugin Vulnerable versions = 4.5.1 Fixed in 4.5.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37096 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID aaf62ab75160 Credits Abdi Pranata Required privile...

PT-2024-12291 · WordPress · Materialis

Name of the Vulnerable Software and Affected Versions: Materialis theme for WordPress versions up to, and including, 1.1.24 Description: The issue is due to missing authorization checks on the companion disable popup function called via an AJAX action. This allows authenticated attackers, with...

WordPress theme Materialis security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

SUSE-SU-2024:1499-2 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: - CVE-2024-21011: Fixed denial of service due to long Exception message logging JDK-8319851,bsc1222979 - CVE-2024-21012: Fixed unauthorized data modification due HTTP/2 client improper reverse DNS lookup JDK-8315708,bsc1222987 -...

CVE-2024-3276

The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when...

CVE-2024-3276

The CVE-2024-3276 issue concerns FooBox FooBox Premium and Lightbox & Modal Popup WordPress plugins (versions prior to 2.7.28). The vulnerability arises because certain plugin settings are not properly sanitized/escaped, enabling a stored cross-site scripting (XSS) attack that could affect high-p...

CVE-2024-3236

The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-3236 Easy Notify Lite < 1.1.33 - Contributor+ Stored XSS

The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-3236 Easy Notify Lite < 1.1.33 - Contributor+ Stored XSS

The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks...