PT-2024-36231 · Skt Themes · Skt Themes Barter

Name of the Vulnerable Software and Affected Versions: SKT Themes Barter versions 1.6 and below Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically DOM-Based XSS. This problem occur...

PT-2024-11756 · 8 Degree Themes · 8Degree Themes Coming Soon Landing Page/Maintenance Mode Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: 8Degree Themes Coming Soon Landing Page and Maintenance Mode WordPress Plugin versions 2.2.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows for broken access control and the retrieval of...

MAL-2024-11777 Malicious code in themes-vendor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c01e7f6fdbbed9b6db3db6a981479a8264b303dedb88de43a2b051db3b1e0498 The OpenSSF Package Analysis project identified 'themes-vendor' @ 0.0.3 npm as malicious. It is considered malicious because: - The package...

Malicious code in themes-vendor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c01e7f6fdbbed9b6db3db6a981479a8264b303dedb88de43a2b051db3b1e0498 The OpenSSF Package Analysis project identified 'themes-vendor' @ 0.0.3 npm as malicious. It is considered malicious because: - The package...

CVE-2023-30476

Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2...

CVE-2023-28416

Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankhe: from n/a through 1.0.5...

CVE-2023-28416

CVE-2023-28416 affects the WordPress Chankhe theme (Sparkle Themes) up to version 1.0.5. Root cause: Missing Authorization due to incorrectly configured access control, enabling authenticated users (Subscriber) to activate plugins arbitrarily. Impact is limited to authenticated plugin-activation ...

PT-2024-12159 · Sparkle Themes · Chankhe

Name of the Vulnerable Software and Affected Versions: Chankhe versions 1.0.5 and earlier Description: The issue is related to a Missing Authorization vulnerability in Sparkle Themes Chankhe, which allows exploiting incorrectly configured access control security levels. Recommendations: For Chank...

Winter 安全漏洞

Winter is a free and open source content management system based on the Laravel PHP framework by Winter Open Source. A security vulnerability exists in Winter versions prior to 1.2.7, 1.1.11, and 1.0.476, which stems from a user being able to bypass the sandboxing restriction of Twig files by...

PT-2024-36103 · Codegear · Codegearthemes Designer

Name of the Vulnerable Software and Affected Versions: CodegearThemes Designer versions 1.3.3 and earlier Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local...

CVE-2024-53762

Cross-Site Request Forgery CSRF vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Stored XSS.This issue affects FastBook: from n/a through = 1.1...

CVE-2024-53762

CVE-2024-53762 is a CSRF to Stored XSS vulnerability affecting the WordPress plugin FastBook – Responsive Appointment Booking and Scheduling System (FastBook) versions up to 1.1. The CVSS 3.1 base score is 7.1 (HIGH) with network attack vector, low attack complexity, no privileges required, but u...

CVE-2024-51899

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in seothemes Simple Pricing Table simple-pricing-table allows Stored XSS.This issue affects Simple Pricing Table: from n/a through = 1.0.0...

CVE-2024-51822

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in keonthemes Creative Blocks creative-blocks allows Stored XSS.This issue affects Creative Blocks: from n/a through = 1.0.1...

CVE-2024-50417

Missing Authorization vulnerability in BoldThemes Bold Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Page Builder: from n/a through 5.1.3...

CVE-2024-51634

CVE-2024-51634 describes a CSRF to Reflected XSS vulnerability in the WordPress plugin Webriti Custom Login (Webriti Shop plugins), affecting versions up to 0.3. The provided documents confirm the issue and its affected range, but do not include a published fix version or concrete remediation ste...

CVE-2024-51822

CVE-2024-51822 is a Stored XSS vulnerability in WordPress Creative Blocks (Keon Themes Creative Blocks) up to version 1.0.1, caused by improper neutralization of input during web page generation. Affects Creative Blocks:

CVE-2024-51822 WordPress Creative Blocks plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Keon Themes Creative Blocks allows Stored XSS.This issue affects Creative Blocks: from n/a through 1.0.1...

CVE-2024-51899

The CVE-2024-51899 entry covers the WordPress plugin Simple Pricing Table (versions

CVE-2024-51899 WordPress Simple Pricing Table plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SEO Themes Simple Pricing Table allows Stored XSS.This issue affects Simple Pricing Table: from n/a through 1.0.0...