5221 matches found
CVE-2024-1808: Improper Neutralization of Input During Web Page Generation
The WP Shortcodes Plugin β Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'suqrcode' shortcode in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
WordPress Shortcodes Ultimate Plugin <= 7.0.3 is vulnerable to Cross Site Scripting (XSS)
Software Shortcodes Ultimate Type Plugin Vulnerable versions = 7.0.3 Fixed in 7.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1808 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79f47d814a15 Credits Webbernaut Required...
Exploit for SQL Injection in Ultimatemember Ultimate_Member
CVE-2024-1071 Ultimate Member Unauthorized Database Access...
WordPress Plugin Alert - Critical SQLi Vulnerability Threatens 200K+ Websites
A critical security flaw has been disclosed in a popular WordPress plugin called Ultimate Member that has more than 200,000 active installations. The vulnerability, tracked as CVE-2024-1071, carries a CVSS score of 9.8 out of a maximum of 10. Security researcher Christiaan Swiers has been credite...
Ultimate Member 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
Description The plugin does not sanitize and escape the sorting parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks when the "Enable custom table for usermeta" option is enabled. Requirement: "Enable custom table for usermeta" option to be...
Restrict User Access β Ultimate Membership & Content Protection < 2.6 - Information Exposure
Description The Restrict User Access β Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages via API...
Ultimate Member 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
Description The plugin does not sanitize and escape the sorting parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks when the "Enable custom table for usermeta" option is enabled. PoC Requirement: "Enable custom table for usermeta" option t...
$2,063 Bounty Awarded for Unauthenticated SQL Injection Vulnerability Patched in Ultimate Member WordPress Plugin
π Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through February 29th, 2024 when you opt to have Wordfence handle responsible disclosure! On January 30th, 2024, shortly after the launch of our secon...
PeproDev Ultimate Invoice < 1.9.8 - Unauthenticated Arbitrary Invoice Access
Description The plugin is vulnerable to Sensitive Information Exposure via the 'initplugin' function. This makes it possible for unauthenticated attackers to generate PDF or ZIP files of arbitrary invoices and extract sensitive data...
VulnCheck KEV: CVE-2024-1071
A SQL Injection is present in WordPress The Ultimate Member plugin...
WordPress Ultimate Member Plugin 2.1.3-2.8.2 is vulnerable to SQL Injection
Software Ultimate Member Type Plugin Vulnerable versions 2.1.3-2.8.2 Fixed in 2.8.3 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-1071 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID d52d7ae096c8 Credits Christiaan Swiers Required privilege...
CVE-2024-0792
CVE-2024-0792 affects the WordPress WP Shortcodes Plugin β Shortcodes Ultimate up to version 7.0.1. The issue is stored XSS via the pluginβs shortcodes in RSS feed content due to insufficient input sanitization and output escaping. Exploitation requires authentication at contributor level or high...
PT-2024-15824
Name of the Vulnerable Software and Affected Versions WP Shortcodes Plugin β Shortcodes Ultimate plugin for WordPress versions up to, and including, 7.0.1 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on RSS feed content...
CVE-2024-0792: Improper Neutralization of Input During Web Page Generation
The WP Shortcodes Plugin β Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.1 due to insufficient input sanitization and output escaping on RSS feed content. This makes it possible for...
WordPress PeproDev Ultimate Invoice Plugin <= 1.9.7 is vulnerable to Sensitive Data Exposure
Software PeproDev Ultimate Invoice Type Plugin Vulnerable versions = 1.9.7 Fixed in 1.9.8 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-25933 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 06191f6ec08b Credits Abdi Pranata...
WordPress Shortcodes Ultimate Plugin <= 7.0.2 is vulnerable to Cross Site Scripting (XSS)
Software Shortcodes Ultimate Type Plugin Vulnerable versions = 7.0.2 Fixed in 7.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1510 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 83c77f226026 Credits Richard Telleng...
CVE-2024-1510: Improper Neutralization of Input During Web Page Generation
The WP Shortcodes Plugin β Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sutooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on user supplied attributes and user supplie...
CVE-2024-0656: Improper Neutralization of Input During Web Page Generation
The Password Protected β Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Captcha Site Key in all versions up to, and including, 2.6.6 due to insufficient input sanitization and output escaping...
NEX-Forms β Ultimate Form Builder < 8.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Description The NEX-Forms β Ultimate Form Builder β Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 8.5.5 due to insufficient input sanitization and output escaping on user supplied...
Ultimate Posts Widget < 2.3.1 - Admin+ Stored XSS
Description The plugin does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...