CVE-2021-4447 Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation

The Essential Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers wi...

CVE-2021-4447

CVE-2021-4447 affects the WordPress plugin Essential Addons for Elementor (versions up to 4.6.4). The root cause is a lack of access restrictions on who can add a registration form and a custom registration role to an Elementor page, enabling attackers with Elementor access to create a registrati...

PT-2024-11044 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to and including 4.6.4 Description: The issue is related to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created...

WordPress UserPlus plugin <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation vulnerability

Authenticated Editor+ Registration Form Update to Privilege Escalation vulnerability discovered by István Márton in WordPress Plugin UserPlus versions = 2.0...

CVE-2024-9519 UserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'savemetaboxform' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update t...

PT-2024-39673 · WordPress · Userplus

Name of the Vulnerable Software and Affected Versions: UserPlus plugin for WordPress versions up to, and including, 2.0 Description: The issue arises from an improper capability check on the save metabox form function, allowing authenticated attackers with editor-level permissions or above to...

CVE-2024-9092 SourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scripting

A vulnerability was found in SourceCodester Profile Registration without Reload Refresh 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file add.php of the component Registration Form. The manipulation of the argument fullname leads to cross site...

CVE-2024-9092

CVE-2024-9092 affects SourceCodester Profile Registration without Reload Refresh 1.0. The vulnerability exists in the Registration Form’s add.php, where manipulating the full_name parameter leads to cross-site scripting. The issue can be triggered remotely and the exploit has been disclosed publi...

HYSCALE System 1.9 Add Administrator / Cross Site Request Forgery

============================================================================================================================================= | Title : HYSCALE System v1.9 CSRF add admin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64...

CVE-2024-8246

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

CVE-2024-8246 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to se...

CVE-2024-8246

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress (BuddyForms) has a privilege-escalation vulnerability in all versions up to and including 2.8.11. The root cause is inadequate restriction of what users can ...

CVE-2024-8605

A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/registration.php of the component Registration Form. The manipulation with the input alert1 leads to cross site scripting. The attack can be...

CVE-2024-8605

CVE-2024-8605 affects code-projects Inventory Management 1.0, specifically the Registration Form component in the /view/registration.php file. The issue is a cross-site scripting flaw triggered by manipulating input such as , with remote initiation and public disclosure of exploits. Multiple conn...

CVE-2024-8605 code-projects Inventory Management Registration Form registration.php cross site scripting

A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/registration.php of the component Registration Form. The manipulation with the input alert1 leads to cross site scripting. The attack can be...

CVE-2024-8605 code-projects Inventory Management Registration Form registration.php cross site scripting

A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/registration.php of the component Registration Form. The manipulation with the input alert1 leads to cross site scripting. The attack can be...

PT-2024-39126 · Code Projects · Code-Projects Inventory Management

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management version 1.0 Description: A problematic issue was found in the Registration Form component, specifically in the /view/registration.php file. The issue allows for cross-site scripting when an attacker...

Medical Center Portal 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Medical Center Portal 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits ...

CVE-2024-5282 WP Affiliate Platform < 6.5.1 - Reflected XSS via Registration Form

The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-27454 · Unknown · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: WooCommerce versions 8.8 through 8.8.4 WooCommerce versions 8.9 through 8.9.2 Description: A cross-site scripting vulnerability in WooCommerce allows a bad actor to manipulate a link to include malicious HTML and JavaScript content. The...