CVE-2024-30502 WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9...

CVE-2024-30502 WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9...

CVE-2024-30502

CVE-2024-30502 affects WP Travel Engine (WordPress) up to version 5.7.9, with an unauthenticated SQL Injection caused by improper neutralization of input in the plugin. This can lead to full confidentiality, integrity, and availability impact as indicated by CVSS scores (NVD: 9.8 CRITICAL; ATT&CK...

PT-2024-23431 · Unknown · Wp Travel Engine

Name of the Vulnerable Software and Affected Versions: WP Travel Engine versions through 5.7.9 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection. This allows for potential manipulation of SQL commands, which cou...

WordPress Plugin WP Travel Engine SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin WP Travel Engine is...

WordPress Plugin WP Travel Engine SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin WP Travel Engine is...

PT-2024-23429

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions through 5.7.9 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting malicious...

WordPress WP Travel Engine Plugin <= 5.7.9 is vulnerable to SQL Injection

Software WP Travel Engine Type Plugin Vulnerable versions = 5.7.9 Fixed in 5.8.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30502 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 275fbb9060ec Credits Yudistira Arya Required privilege...

WordPress WP Travel Engine Plugin <= 5.7.9 is vulnerable to SQL Injection

Software WP Travel Engine Type Plugin Vulnerable versions = 5.7.9 Fixed in 5.8.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30504 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 80130919606b Credits Yudistira Arya Required privilege Administrator...

WordPress WP Travel Engine Plugin < 5.7.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Travel Engine Type Plugin Vulnerable versions 5.7.5 Fixed in 5.7.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 801294ac323a Credits Rafie Muhammad Patchstack Require...

WordPress WP Travel Engine plugin <= 5.3.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Travel Engine plugin versions = 5.3.7. Solution Update the WordPress WP Travel Engine plugin to the latest available version at least 5.3.8...

WordPress WP Travel Engine plugin <= 5.3.7 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Travel Engine plugin versions = 5.3.7. Solution Update the WordPress WP Travel Engine plugin to the latest available version at least 5.3.8...

WordPress WP Travel Engine plugin跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WP Travel Engine plugin prior to 5.3.1, whic...

CVE-2021-24680

The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is...

CVE-2021-24680

The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is...

Cross site scripting

The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is...

CVE-2021-24680

The WP Travel Engine WordPress plugin prior to 5.3.1 is affected by a Stored Cross‑Site Scripting (XSS) vulnerability. The root cause is failing to escape the Description field on Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with as low as editor role to inject...

CVE-2021-24680 WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting

The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is...

WordPress plugin WP Travel Engine跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WP Travel Engine plugin prior to 5.3.1, whic...

WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting

The plugin does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfilteredhtml capability is disallowed PoC As an editor or admin, ad...