WordPress Zita Elementor Site Library plugin <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Zita Elementor Site Library versions = 1.6.3...

WordPress Zita Elementor Site Library Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)

Software Zita Elementor Site Library Type Plugin Vulnerable versions = 1.6.3 Fixed in 1.6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8921 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 13fd5fea2d7c Credits Francesco...

WordPress plugin Zita Elementor Site Library 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2024-8921: Improper Neutralization of Input During Web Page Generation

The Zita Elementor Site Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acce...

CVE-2024-37420 WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affects Zita Elementor Site Library: from n/a through 1.6.1...

CVE-2024-37420

CVE-2024-37420: Zita Elementor Site Library (WordPress plugin) versions 1.6.1) or patch is available; as a workaround, restrict uploads to safe file types until patched. The vulnerability is tracked across multiple sources and is marked as patched in known advisories.

CVE-2024-37420 WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affects Zita Elementor Site Library: from n/a through 1.6.1...

PT-2024-27538 · Unknown · Zita Elementor Site Library

Name of the Vulnerable Software and Affected Versions: Zita Elementor Site Library versions 1.6.1 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling the upload of a web shell to a web server. This could be exploited by uploadi...

WordPress plugin Zita Elementor Site Library Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

CVE-2024-37420: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in WPZita Zita Elementor Site Library allows Upload a Web Shell to a Web Server.This issue affects Zita Elementor Site Library: from n/a through 1.6.1...

WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Zita Elementor Site Library versions = 1.6.1...

WordPress Zita Elementor Site Library plugin <= 1.6.2 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Lucio Sá in WordPress Plugin Zita Elementor Site Library versions = 1.6.2...

WordPress Plugin Zita Elementor Site Library Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2024-3249: Missing Authorization

The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importxmldata, xmldataimport, importoptiondata, importwidgets, and importcustomizersettings functions in all versions up to, and including, 1.6.2. This...

WordPress Zita Elementor Site Library Plugin <= 1.6.2 is vulnerable to Broken Access Control

Software Zita Elementor Site Library Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3249 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ee7892685efa Credits Lucio Sá Required...

PT-2024-24612

Name of the Vulnerable Software and Affected Versions Zita Elementor Site Library plugin for WordPress versions up to, and including, 1.6.2 Description The issue allows authenticated attackers with subscriber-level access and above to modify data without proper authorization due to a missing...

CVE-2024-33644

Improper Control of Generation of Code 'Code Injection' vulnerability in WPCustomify Customify Site Library allows Code Injection.This issue affects Customify Site Library: from n/a through 0.0.9...

CVE-2024-33644 WordPress Customify Site Library plugin <= 0.0.9 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in WPCustomify Customify Site Library allows Code Injection.This issue affects Customify Site Library: from n/a through 0.0.9...

CVE-2024-33644

CVE-2024-33644 is an unauthenticated remote code execution vulnerability in the WPCustomify Customify Site Library (WordPress plugin). Technical details across sources show code-injection via improper control of generated code, affecting Customify Site Library versions from 0.0.0 up to and includ...

CVE-2024-33644 WordPress Customify Site Library plugin <= 0.0.9 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in WPCustomify Customify Site Library allows Code Injection.This issue affects Customify Site Library: from n/a through 0.0.9...