9551 matches found
PT-2024-4870 · Juniper Networks · Junos
Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 20.4R3-S5 Junos OS versions from 21.1 before 21.1R3-S4 Junos OS versions from 21.2 before 21.2R3-S3 Junos OS versions from 21.3 before 21.3R3-S5 Junos OS versions from 21.4 before 21.4R3-S5 Junos OS versions from 22...
CVE-2024-2348
The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...
CVE-2024-2018
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry-roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...
CVE-2024-1991
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the updateusersrole function in all versions up to, and including, 5.3.0.0. This makes it possible for...
CVE-2024-1352
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtclimportlocation rtclimportcategory functions in all versions up to, and including, 3.0.4. This makes it...
CVE-2024-1352
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtclimportlocation rtclimportcategory functions in all versions up to, and including, 3.0.4. This makes it...
CVE-2024-2341 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2024-2348 Gum Elementor Addon <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget
The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...
CVE-2024-1850 AI Post Generator | AutoWriter <= 3.3 - Missing Authorization
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with...
CVE-2024-1850 AI Post Generator | AutoWriter <= 3.3 - Missing Authorization
The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with...
CVE-2024-2018 WP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injection
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry-roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...
CVE-2024-1904 MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts
The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the searchposts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose...
CVE-2024-2033 Video Conferencing with Zoom <= 4.4.5 - Sensitive Information Exposure
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the getassignhostid AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emai...
CVE-2024-2033 Video Conferencing with Zoom <= 4.4.5 - Sensitive Information Exposure
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the getassignhostid AJAX action. This makes it possible for authenticated attackers, with subscriber access or higher, to enumerate usernames, emai...
WordPress Post Type Builder (PTB) plugin < 2.1.4 - Subscriber+ Arbitrary Post/Page Creation vulnerability
Subscriber+ Arbitrary Post/Page Creation vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Post Type Builder PTB versions 2.1.4...
PT-2024-18361 · WordPress · Autowriter
Name of the Vulnerable Software and Affected Versions: AutoWriter plugin for WordPress versions up to, and including, 3.3 Description: The issue allows authenticated attackers with subscriber access or higher to access, modify, or delete posts due to a missing capability check on functions hooked...
WP Activity Log Premium < 4.6.4.1 - Authenticated (Subscriber+) SQL Injection
Description The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry-roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
WordPress WP-Stateless Plugin <= 3.4.0 is vulnerable to Broken Access Control
Software WP-Stateless Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1385 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 12374ce1567e Credits Krzysztof Zając Required...
WordPress Image Watermark Plugin <= 1.7.3 is vulnerable to Broken Access Control
Software Image Watermark Type Plugin Vulnerable versions = 1.7.3 Fixed in 1.7.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1994 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 790ca7ba3a40 Credits Lucio Sá Required privilege...
WordPress WP2LEADS Plugin <= 3.2.7 is vulnerable to Broken Access Control
Software WP2LEADS Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31375 Patch priority Low CVSS severity Low 5.4 Developer Tobias PSID 685ef08b2881 Credits Dhabaleshwar Das Required privilege Subscribe...