pb-cms 跨站脚本漏洞

pb-cms waterfall content management system is a content management system by LinZhaoguan personal developer. A cross-site scripting vulnerability exists in pb-cms versions prior to 2.0.1, which stems from the component Theme Management Module's file /adminthemes that can lead to cross-site...

PT-2024-16307 · Linzhaoguan · Linzhaoguan Pb-Cms

Name of the Vulnerable Software and Affected Versions: LinZhaoguan pb-cms versions up to 2.0.1 Description: A problematic issue was found in the Theme Management Module of the affected software, specifically in an unknown function of the file /adminthemes. This issue leads to cross-site scripting...

CVE-2024-50447

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce allows Stored XSS.This issue affects Envo's Elementor Templates & Widgets for WooCommerce: from n/a through 1.4.19...

CVE-2024-50441

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in CozyThemes Cozy Blocks allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.0.15...

CVE-2024-50501

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Climax Themes Kata Plus kata-plus allows DOM-Based XSS.This issue affects Kata Plus: from n/a through = 1.4.7...

CVE-2024-50501

CVE-2024-50501 is a stored XSS in the Kata Plus WordPress plugin (Kata Plus:

CVE-2024-50501 WordPress Kata Plus plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Climax Themes Kata Plus kata-plus allows DOM-Based XSS.This issue affects Kata Plus: from n/a through = 1.4.7...

CVE-2024-50501 WordPress Kata Plus plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Climax Themes Kata Plus kata-plus allows DOM-Based XSS.This issue affects Kata Plus: from n/a through = 1.4.7...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 7, 2024 to October 13, 2024)

Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024: All in-scope vulnerability types for WordPress plugins/themes with = 1,000 active installations are...

CVE-2024-48036

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sonalsinha21 SKT Blocks skt-blocks.This issue affects SKT Blocks: from n/a through = 1.6...

CVE-2024-48036 WordPress SKT Blocks plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sonalsinha21 SKT Blocks skt-blocks.This issue affects SKT Blocks: from n/a through = 1.6...

CVE-2024-48036

The CVE-2024-48036 entry concerns the SKT Blocks – Gutenberg based Page Builder WordPress plugin. Affected: SKT Blocks versions 1.6 and earlier. Issue: Improper neutralization of inputs during page generation, resulting in Stored XSS. Impact: Cross-site scripting vulnerability with potential for ...

CVE-2022-4974

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the getdebuglog, getdboption, and the setdboption functions in versions up to, and...

CVE-2022-4974

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the getdebuglog, getdboption, and the setdboption functions in versions up to, and...

CVE-2022-4974

The connected sources confirm CVE-2022-4974 concerns the Freemius SDK used in WordPress plugins/themes, with a root cause of missing capability checks and nonce protection in the functions _get_debug_log, _get_db_option, and _set_db_option. Versions up to and including 2.4.2 are vulnerable to Cro...

CVE-2024-9232

The WordPress plugin Download Plugins and Themes in ZIP from Dashboard is vulnerable to Reflected XSS in versions ≤ 1.9.1 due to improper escaping of URLs via add_query_arg, enabling unauthenticated attackers to inject scripts if a user is persuaded to click a crafted link. Affected: Download Plu...

CVE-2024-9232 Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to...

WordPress Download Plugins and Themes in ZIP from Dashboard plugin <= 1.9.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Download Plugins and Themes from Dashboard versions = 1.9.1...

CVE-2024-44010

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Catch Themes Full frame allows Stored XSS.This issue affects Full frame: from n/a through 2.7.2...

CVE-2024-44010 WordPress Full frame theme <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchthemes Full frame full-frame allows Stored XSS.This issue affects Full frame: from n/a through = 2.7.2...