3954 matches found
CVE-2021-24271
CVE-2021-24271 affects the WordPress plugin Ultimate Addons for Elementor (before 1.30.0). The vulnerability is a stored XSS in several widgets, exploitable by lower-privileged users (e.g., contributors) via a similar method. Connected sources confirm the affected version and context; the advisor...
Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)
The plugin did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue /wp-admin/admin.php?page=ultimate-maps-supsystic&tab="onmouseover=alert1//...
WordPress Ultimate Maps by Supsystic plugin <= 1.2.4 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by 0xB9 in WordPress Ultimate Maps by Supsystic plugin versions = 1.2.4. Solution Update the WordPress Ultimate Maps by Supsystic to the latest available version at least 1.2.5...
WordPress Ultimate Addons for Elementor premium plugin <= 1.29.2 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by WordFence in WordPress Ultimate Addons for Elementor premium plugin versions = 1.29.2. Solution Update the WordPress Ultimate Addons for Elementor premium plugin to the latest available version at least 1.30.0...
Ultimate Maps by Supsystic < 1.1.17 - Authenticated SQL Injections
The GET parameters sidx and sord were used in a SQL statement without being sanitised when searching for maps in the dashboard, leading to an authenticated SQL Injection issues...
WordPress Ultimate Maps by Supsystic plugin <= 1.1.14 - SQL injection (SQLi) vulnerability
SQL injection SQLi vulnerability found by Erik David Martin in WordPress Ultimate Maps by Supsystic plugin versions = 1.1.14. Solution Update the WordPress Ultimate Maps by Supsystic plugin to the latest available version at least 1.1.16...
WordPress Plugin Supsystic Ultimate Maps 1.1.12 - 'sidx' SQL injection
Exploit Title: WordPress Plugin Supsystic Ultimate Maps 1.1.12 - 'sidx' SQL injection Date: 24/07/2020 Exploit Author: Erik David Martin Vendor Homepage: https://supsystic.com/ Software Link: https://downloads.wordpress.org/plugin/ultimate-maps-by-supsystic.1.1.12.zip Category: Web Application...
WordPress Supsystic Ultimate Maps 1.1.12 SQL Injection
Exploit Title: WordPress Plugin Supsystic Ultimate Maps 1.1.12 - 'sidx' SQL injection Date: 24/07/2020 Exploit Author: Erik David Martin Vendor Homepage: https://supsystic.com/ Software Link: https://downloads.wordpress.org/plugin/ultimate-maps-by-supsystic.1.1.12.zip Category: Web Application...
CVE-2021-3258
Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...
CVE-2021-3258
Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...
Cross site scripting
Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...
CVE-2021-3258
Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...
CVE-2021-3258
CVE-2021-3258 affects Question2Answer Q2A Ultimate SEO Version 1.3. The connected documents confirm a cross-site scripting (XSS) vulnerability that may lead to arbitrary remote code execution. The issue is described across NVD and Red Hat/NVD and third-party sources as an XSS flaw with potential ...
CVE-2021-3258
Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...
Question2Answer Q2A Ultimate SEO Cross-Site Scripting Vulnerability
Q2A Ultimate SEO is a component from the Q2A Projects team that provides search engine optimization functionality for Question2Answer. Question2Answer Q2A Ultimate SEO Version 1.3 suffers from a cross-site scripting vulnerability that leads to arbitrary remote code execution...
WordPress Ultimate Member Plugin <= 2.1.12 Deprecated UM Forms Field Vulnerability
The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
WordPress ultimate-category-excluder plugin cross-site request forgery vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Ultimate-category-excluder Plugin...
WordPress Ultimate Member plugin input validation error vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create member sites or online communities. An input validation error vulnerability...