WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Ultimate Member Type Plugin Vulnerable versions = 2.6.0 Fixed in 2.6.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-31216 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 08a533c99ec9 Credits Nguyen Xuan Chien...

CVE-2022-47586

Unauth. SQL Injection SQLi vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.1.23 versions...

Sql injection

Unauth. SQL Injection SQLi vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.1.23 versions...

CVE-2022-47586

Unauth. SQL Injection SQLi vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.1.23 versions...

CVE-2022-47586

CVE-2022-47586 concerns the WordPress plugin Ultimate Addons for Contact Form 7 (Themefic) with versions

CVE-2022-47586 WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

Unauth. SQL Injection SQLi vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.1.23 versions...

CVE-2023-2812

The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2812 Ultimate Dashboard < 3.7.6 - Admin+ Stored XSS

The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2812 Ultimate Dashboard < 3.7.6 - Admin+ Stored XSS

The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2812: Undefined Security Weakness

The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2023-21577

Name of the Vulnerable Software and Affected Versions The Ultimate Dashboard WordPress plugin versions prior to 3.7.6 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitise...

PT-2023-15409 · Unknown · Themefic Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Themefic Ultimate Addons for Contact Form 7 plugin versions prior to 3.1.24 Description: The issue is related to an Unauth. SQL Injection SQLi vulnerability. This means that an attacker could potentially inject malicious SQL code into the...

WordPress Plugin Ultimate Dashboard 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2022-47586: Improper Neutralization of Special Elements used in an SQL Command

Unauth. SQL Injection SQLi vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin = 3.1.23 versions...

Sql injection

The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries...

CVE-2023-1615

The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries...

WordPress Plugin Ultimate Addons for Contact Form SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Ultimate Addons for Contac...

PT-2023-17120 · WordPress · Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: The Ultimate Addons for Contact Form 7 plugin for WordPress versions up to and including 3.1.23 Description: The issue allows authenticated attackers of any authorization level to perform SQL Injection via the id parameter. This enables them ...

CVE-2023-1615: Undefined Security Weakness

The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in versions up to, and including, 3.1.23. This makes it possible for authenticated attackers of any authorization level to append additional SQL queries into already existing queries...

WordPress Ultimate Product Catalogue Plugin <= 5.2.5 is vulnerable to SQL Injection

Software Ultimate Product Catalogue Type Plugin Vulnerable versions = 5.2.5 Fixed in 5.2.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2711 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID b491eeb6f795 Credits Ilyase Dehy Required privilege...