WordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.9 - Authenticated (Contributor+) Post Disclosure vulnerability

Authenticated Contributor+ Post Disclosure vulnerability discovered by Francesco Carlucci in WordPress Plugin Enter Addons versions = 2.1.9...

CVE-2024-11355 Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getsetting function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level...

WordPress plugin Ultimate YouTube Video & Shorts Player With Vimeo 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2024-16601 · WordPress · Enter Addons – Ultimate Template Builder For Elementor

Name of the Vulnerable Software and Affected Versions: The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress versions up to, and including, 2.1.9 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private or...

WordPress Ultimate Member plugin <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary User Profile Picture Update vulnerability discovered by tiborisaak in WordPress Plugin Ultimate Member versions = 2.8.9...

WordPress Ultimate YouTube Video & Shorts Player With Vimeo plugin <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Setting Exposure vulnerability discovered by Mika in WordPress Plugin Ultimate YouTube Video & Shorts Player With Vimeo versions = 3.3...

CVE-2024-10528

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wpajaxumresizeimage and ajaxresizeimage functions in all versions ...

CVE-2024-10528 Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wpajaxumresizeimage and ajaxresizeimage functions in all versions ...

CVE-2024-10528 Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wpajaxumresizeimage and ajaxresizeimage functions in all versions ...

CVE-2024-10528

CVE-2024-10528 (Ultimate Member) affects WordPress plugin Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership. The root cause is a missing capability check in the image resize handlers (wp_ajax_um_resize_image() and ajax_resize_image()), which a...

WordPress plugin Ultimate Member 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Ultimate Member Plugin <= 2.8.9 is vulnerable to Broken Access Control

Software Ultimate Member Type Plugin Vulnerable versions = 2.8.9 Fixed in 2.9.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10528 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 65aa5e86b9d5 Credits tiborisaak Required privilege...

CVE-2024-52448

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through = 1.7...

WordPress plugin Ultimate Classified Listings 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2024-51870

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dragwyb Ultimate Flipbox Addon for Elementor ultimate-flipbox-addon-for-elementor allows Stored XSS.This issue affects Ultimate Flipbox Addon for Elementor: from n/a through 1.0.4...

CVE-2024-51797

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Md. Shiddikur Rahman Ultimate Accordion ultimate-accordion allows DOM-Based XSS.This issue affects Ultimate Accordion: from n/a through = 1.0...

CVE-2024-51797

CVE-2024-51797 describes a DOM-based XSS in the WordPress plugin Ultimate Accordion by Md. Shiddikur Rahman. The vulnerability is an improper input neutralization during web page generation, allowing cross-site scripting. Affected products/versions: Ultimate Accordion

CVE-2024-51797 WordPress Ultimate Accordion plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Md. Shiddikur Rahman Ultimate Accordion ultimate-accordion allows DOM-Based XSS.This issue affects Ultimate Accordion: from n/a through = 1.0...

CVE-2024-51870

CVE-2024-51870 corresponds to a stored cross‑site scripting (XSS) vulnerability in the WordPress plugin “Ultimate Flipbox Addon for Elementor.” Affected: Ultimate Flipbox Addon for Elementor versions up to 1.0.4 (auth required). Root cause: improper neutralization of user input during web page ge...

WordPress Ultimate Classified Listings plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Plugin Ultimate Classified Listings versions = 1.7...