53 matches found
CVE-2021-38314
Unbestätigte Offenlegung sensibler Informationen CVE-2021-38314 Python-Exploit für CVE-2021-38314 Verwendung: python3 cve-2021-38314.py http://www.target.com Das Gutenberg Template Library & Redux Framework Plugin = 4.2.11 für WordPress registrierte mehrere AJAX-Aktionen, die für nicht...
CVE-2021-38314
CVE-2021-38314 Exploit Python Dettaglio Il plugin Gutenberg Template Library & Redux Framework Esempio PoC - https://youtu.be/n1e4aFmXvOk Link CVE-2021-38314...
CVE-2021-38314
CVE-2021-38314 Qual è la vulnerabilità? Il plugin Gutenberg Template Library & Redux Framework = 4.2.11 per WordPress registrava diverse azioni AJAX disponibili per utenti non autenticati nella funzione includes in redux-core/class-redux-core.php che erano uniche per un dato sito ma deterministic...
cve-2021-38314
cve-2021-38314 - अप्रमाणित संवेदनशील जानकारी का खुलासा Gutenberg Template Library और Redux Framework प्लगइन = 4.2.11 WordPress के लिए, redux-core/class-redux-core.php में includes फ़ंक्शन में कई AJAX क्रियाएं पंजीकृत थीं जो अप्रमाणित उपयोगकर्ताओं के लिए उपलब्ध थीं। ये क्रियाएं किसी विशेष साइट के...
WordPress Redux Framework <=4.2.11 - Information Disclosure
WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 has...
cve-2021-38314
استغلال بايثون لثغرة CVE-2021-38314 التفاصيل سجّل المكوّن الإضافي Gutenberg Template Library & Redux Framework الخاص بووردبريس، في الإصدار = 4.2.11، عدة إجراءات AJAX متاحة للمستخدمين غير المصادقين في دالة includes داخل redux-core/class-redux-core.php، وكانت هذه الإجراءات فريدة لكل موقع لكنها حتمي...
CVE-2026-12525
The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile...
CVE-2026-12525
The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile...
CVE-2026-12525
CVE-2026-12525 affects the Redux Framework WordPress plugin prior to 4.5.13. The vulnerability arises because the plugin does not restrict which user_meta keys can be written when saving custom profile fields, enabling users with at least the Subscriber role to escalate to Administrator while upd...
EUVD-2026-44875
The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile...
CVE-2026-12525 Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator
The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile...
CVE-2026-3478
CVE-2026-3478 affects the Content Syndication Toolkit plugin for WordPress (versions
CVE-2025-9488
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
EUVD-2025-203202
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2025-9488
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2025-9488 Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
CVE-2025-9488
CVE-2025-9488 affects the Redux Framework WordPress plugin (≤4.5.8). It enables Stored Cross‑Site Scripting via the data parameter by authenticated users with Contributor+; scripts execute on the affected pages when loaded. Wordfence reports this CVE as patched (patch status: Patched); no exploit...
CVE-2025-9488 Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...
WordPress plugin Redux Framework 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...
PT-2025-51085
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...