WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio plugin <= 2.1.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio plugin versions = 2.1.6. Solution Update the WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio plugin to the late...

WordPress Royal Elementor Addons (Header Footer Builder, Popups, Post Grid, Woocommerce Product Grid, Slider, Parallax Image, Free Elementor Widgets & Elementor Templates) plugin <= 1.3.32 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Royal Elementor Addons Header Footer Builder, Popups, Post Grid, Woocommerce Product Grid, Slider, Parallax Image, Free Elementor Widgets & Elementor Templates plugin versions = 1.3.32. Solution Update the WordPress Royal...

WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)

Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting XSS Date: 3/16/2021 Author: 0xB9 Software Link: https://wordpress.org/plugins/post-grid/ Version: 2.1.1 Tested on: Windows 10 CVE: CVE-2021-24488 1. Description: This plugin creates a post grid from any post types. The slider...

WordPress Post Grid 2.1.1 Cross Site Scripting

Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting XSS Date: 3/16/2021 Author: 0xB9 Software Link: https://wordpress.org/plugins/post-grid/ Version: 2.1.1 Tested on: Windows 10 CVE: CVE-2021-24488 1. Description: This plugin creates a post grid from any post types. The slider...

WordPress Post Grid 2.1.1 Plugin - Cross Site Scripting Vulnerability

Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting XSS Author: 0xB9 Software Link: https://wordpress.org/plugins/post-grid/ Version: 2.1.1 Tested on: Windows 10 CVE: CVE-2021-24488 1. Description: This plugin creates a post grid from any post types. The slider import search...

Post Grid < 2.1.13 - Contributor+ SQL Injection

The plugin does not sanitise and escape user input before using it in a SQL statement when duplicating posts available to Contributor+ users, leading to an SQL Injection...

CVE-2021-24652

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values...

CVE-2021-24659

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

CVE-2021-24661

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID...

CVE-2021-24659

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

CVE-2021-24652

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values...

CVE-2021-24661

The PostX – Gutenberg Blocks for Post Grid WordPress plugin (before 2.4.10) with the Saved Templates Addon enabled permits users with Contributor roles or higher to read password-protected or private post contents they normally cannot access, given a post ID. This is the confirmed issue described...

CVE-2021-24659 PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

PT-2021-16174

Name of the Vulnerable Software and Affected Versions PostX – Gutenberg Blocks for Post Grid WordPress plugin versions prior to 2.4.10 Description The issue allows users with Contributor roles or higher to read password-protected or private post contents they are otherwise unable to read, given t...

PT-2021-16172

Name of the Vulnerable Software and Affected Versions PostX – Gutenberg Blocks for Post Grid WordPress plugin versions prior to 2.4.10 Description The issue allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. Recommendations For...

PT-2021-16173

Name of the Vulnerable Software and Affected Versions PostX – Gutenberg Blocks for Post Grid WordPress plugin versions prior to 2.4.10 Description The issue allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode when the Saved...

CVE-2021-24661: Exposure of Sensitive Information to an Unauthorized Actor

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID...

CVE-2021-24660: Improper Neutralization of Input During Web Page Generation

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode...

CVE-2021-24652: Incorrect Authorization

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values...

CVE-2021-24659: Improper Neutralization of Input During Web Page Generation

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...