10095 matches found
PT-2024-16347 · Kognetiks · Kognetiks Chatbot For Wordpress
Name of the Vulnerable Software and Affected Versions: Kognetiks Chatbot for WordPress plugin versions up to, and including, 2.1.7 Description: The Kognetiks Chatbot for WordPress plugin has a vulnerability that lets users change data without permission due to a missing capability check on the ad...
PT-2024-16345 · Kognetiks · Kognetiks Chatbot For Wordpress
Name of the Vulnerable Software and Affected Versions: Kognetiks Chatbot for WordPress plugin versions up to, and including, 2.1.7 Description: The Kognetiks Chatbot for WordPress plugin is vulnerable to unauthorized modification of data due to a missing capability check on the delete assistant...
WordPress GPX Viewer Plugin <= 2.2.9 is vulnerable to Arbitrary File Upload
Software GPX Viewer Type Plugin Vulnerable versions = 2.2.9 Fixed in 2.2.10 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-10629 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID abb72626a6f6 Credits Francesco Carlucci Required privilege...
WordPress Styler for Ninja Forms Plugin <= 3.3.4 is vulnerable to Settings Change
Software Styler for Ninja Forms Type Plugin Vulnerable versions = 3.3.4 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Settings Change CVE CVE-2024-10717 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2b68f06a005e Credits...
WordPress WP Job Portal Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)
Software WP Job Portal Type Plugin Vulnerable versions = 2.2.0 Fixed in 2.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52389 Patch priority Medium CVSS severity Medium 6.5 Developer Ahmad PSID 3e42293c0184 Credits casol Required privilege Subscriber Publishe...
WordPress KBucket Plugin <= 4.1.6 is vulnerable to Arbitrary File Upload
Software KBucket Type Plugin Vulnerable versions = 4.1.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52369 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 510ec3a237eb Credits stealthcopter Required privilege Subscriber...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Priyabratasarkar Token_Login
CVE-2024-50488 Token Login = 1.0.3 - Authenticated Subscr...
CVE-2024-10589
The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the importsettings function in all versions up to, and including, 3.1.1. This makes it possible for authenticate...
CVE-2024-10589 Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the importsettings function in all versions up to, and including, 3.1.1. This makes it possible for authenticate...
CVE-2024-10589
CVE-2024-10589 - Leopard WordPress Offload Media (plugin) Affected: Leopard - WordPress Offload Media plugin for WordPress, versions up to and including 3.1.1. Root cause: missing capability check in import_settings() function, enabling unauthorized modification of data. Impact: authenticated att...
CVE-2024-10589 Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the importsettings function in all versions up to, and including, 3.1.1. This makes it possible for authenticate...
CVE-2024-10626
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteuploadedfile function in all versions up to, and including, 17.7. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2024-10626 WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteuploadedfile function in all versions up to, and including, 17.7. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2024-10674
CVE-2024-10674 affects the WordPress theme “Th Shop Mania” up to version 1.4.9. The vulnerability arises from a missing capability check in th_shop_mania_install_and_activate_callback(), allowing authenticated attackers (Subscriber level and above) to install arbitrary plugins. Reported evidence ...
CVE-2024-10674 Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the thshopmaniainstallandactivatecallback function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with...
CVE-2024-10673 Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the topstoreinstallandactivatecallback function in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2024-10673 Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the topstoreinstallandactivatecallback function in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level...
PT-2024-16387 · WordPress · Leopard - Wordpress Offload Media
Name of the Vulnerable Software and Affected Versions: Leopard - WordPress Offload Media plugin versions up to, and including, 3.1.1 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the import settings function...
WordPress Th Shop Mania theme <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation vulnerability
Authenticated Subscriber+ Arbitrary Plugin Installation/Activation vulnerability discovered by Sean Murphy, Kevin Murphy knmurphy in WordPress Theme Th Shop Mania versions = 1.4.9...