9968 matches found
CVE-2024-12005 WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting
The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wpbibtexoptionpage function. This makes it possible for unauthenticated attackers to inject malicious web scripts...
CVE-2024-10936
The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursiveunserializereplace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP...
CVE-2024-13536
The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class/fnm/export.php file being publicly accessible with error logging enabled. This makes it possible for unauthenticated attackers to retriev...
CVE-2024-13536 1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure
The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class/fnm/export.php file being publicly accessible with error logging enabled. This makes it possible for unauthenticated attackers to retriev...
WordPress Email Subscribers by Icegram Express 5.7.14 SQL Injection
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress and WooCommerce plugin for WordPress is vulnerable to SQL Injection via the run function of the IGESSubscribersQuery class in all versions up to, and including, 5.7.14 due to insufficient escaping on...
CVE-2025-0584
The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal network...
CVE-2025-0583
The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...
CVE-2024-13184
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions up to, and including, 3.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...
CVE-2024-13184
CVE-2024-13184 — The Ultimate WordPress Toolkit – WP Extended (WordPress) SQL Injection Vulnerability: Time-based SQL Injection via the Login Attempts module in WP Extended <= 3.0.12. Root cause: insufficient escaping of user-provided parameter and inadequate preparation of the SQL query, enab...
CVE-2024-13375
CVE-2024-13375 concerns the Adifier System plugin for WordPress. Vulnerability: unauthenticated attackers can escalate privileges by taking over accounts (including administrators) via adifier_recover(), exploiting insufficient identity validation when updating passwords. Affected versions: all u...
CVE-2024-13317
The ShipWorks Connector for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is due to missing or incorrect nonce validation on the 'shipworks-wordpress' page. This makes it possible for unauthenticated attackers to...
CVE-2024-13432
The Webcamconsult plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web...
CVE-2024-12385 WP Abstracts <= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing nonce validation on the wpabstractsloadstatus and wpabstractsdeleteabstracts functions. This makes it possible for unauthenticated attackers to...
CVE-2024-13432
The CVE-2024-13432 entry concerns the Webcamconsult WordPress plugin. The description states a Cross-Site Request Forgery vulnerability in all versions up to 1.5.0 caused by missing or incorrect nonce validation on a function, enabling unauthenticated attackers to update settings and inject malic...
CVE-2024-13432 Webcamconsult <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Webcamconsult plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web...
CVE-2025-0318
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.9.1 through different error messages in the responses. This makes it possible for...
CVE-2025-0308
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied...
CVE-2024-13516
CVE-2024-13516 affects Kubio AI Page Builder for WordPress. Connected documents confirm a Reflected Cross-Site Scripting flaw exploitable via the message parameter in all versions up to 2.3.5, with unauthenticated user interaction required to trigger execution of injected scripts. The issue is ca...
CVE-2025-0308
The CVE covers WordPress plugin Ultimate Member (versions up to 2.9.1) with a time-based SQL Injection via the search parameter caused by insufficient escaping and lack of proper query preparation, enabling unauthenticated attackers to append SQL to existing queries to extract data. Some connecte...
CVE-2024-13515
The CVE-2024-13515 entry concerns the WordPress plugin Image Source Control Lite – Show Image Credits and Captions, with a Reflected Cross-Site Scripting vulnerability via the path parameter in all versions up to 2.28.0. The root cause is insufficient input sanitization and output escaping, enabl...