CVE-2024-0609

CVE-2024-0609 is a Stored Cross-Site Scripting vulnerability in the WP ERP plugin for WordPress (WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting). Public records describe the issue as: unauthenticated (WordPress users) can inject scripts via the api_ke...

CVE-2024-0609 WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'apikey' parameter in all versions up to, and including, 1.13.1 due to insufficient input sanitization and output escaping. Th...

CVE-2024-0609 WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'apikey' parameter in all versions up to, and including, 1.13.1 due to insufficient input sanitization and output escaping. Th...

CVE-2024-2116 Christmas Greetings <= 1.2.5 - Reflected Cross-Site Scripting

The Christmas Greetings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the code parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-2116

CVE-2024-2116 (Christmas Greetings WordPress plugin) is a Reflected XSS in the code parameter, affecting all versions up to 1.2.5. The vulnerability is exploitable by unauthenticated attackers via crafted input that is reflected on pages executed when a user interacts with a link. The Initial and...

CVE-2024-2970

The CVE CVE-2024-2970 affects the News Wall WordPress plugin (all versions up to 1.1.0). It is a Cross-Site Request Forgery vulnerability caused by missing or incorrect nonce validation in the nwap_newslist_page() function. This enables unauthenticated attackers to update the plugin’s settings an...

CVE-2024-2969

CVE-2024-2969 affects the WP-Eggdrop WordPress plugin (all versions up to 0.1). It is a CSRF flaw caused by missing/incorrect nonce validation in wpegg_updateOptions(), allowing unauthenticated attackers to trigger plugin setting updates via forged requests if a site admin is induced to perform a...

Co-marquage service-public.fr < 0.5.73 - Reflected Cross-Site Scripting via search_term

Description The Co-marquage service-public.fr plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘searchterm’ parameter in versions up to, and including, 0.5.72 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

Ninja Forms Contact Form < 3.8.1 - Publicly Accessible Form Submission Export via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery This is due to missing or incorrect nonce validation on the nfdownloadallsubs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a...

CP Media Player < 1.2.0 - Player Deletion and Duplication via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the adminpage function. This makes it possible for unauthenticated attackers to delete or duplicate existing audio or video players via a forged request granted they can trick a site...

Email Subscribers & Newsletters < 5.7.12 - Reflected Cross-Site Scripting via campaign_id

Description The Email Subscribers & Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘campaignid' parameter in versions up to, and including, 5.7.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-2110

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers...

CVE-2024-2110

The CVE-2024-2110 issue affects the WordPress plugin Events Manager – Calendar, Bookings, Tickets, and more! The Red Hat and Wordfence references confirm a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 6.4.7.1 due to missing/incorrect nonce validation on multiple actions. ...

CVE-2024-2110 Events Manager <= 6.4.7.1 - Cross-Site Request Forgery

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers...

Christmas Greetings <= 1.2.5 - Reflected Cross-Site Scripting

Description The Christmas Greetings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the code parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Dell PowerScale OneFS 代码问题漏洞

Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. A code issue vulnerability exists in Dell PowerScale OneFS that stems from the presence of a session expiration vulnerability that can be exploited by an...

News Wall <= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update

Description The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the nwapnewslistpage function. This makes it possible for unauthenticated attackers to update the plugin'...

PT-2024-22963 · WordPress · Wp-Eggdrop

Name of the Vulnerable Software and Affected Versions: WP-Eggdrop plugin for WordPress versions up to, and including, 0.1 Description: The issue is related to a Cross-Site Request Forgery vulnerability due to missing or incorrect nonce validation in the wpegg updateOptions function. This allows...

WP Reset < 2.0 - Sensitive Information Exposure due to Insufficient Randomness

Description The plugin is vulnerable to Sensitive Information Exposure via the use of insufficiently random snapshot names, allowing unauthenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames...

PT-2025-16951 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions 3.8.1.4 and prior Description: The issue is related to an Improper Certificate Validation, which could be exploited by an unauthenticated attacker with adjacent network access, potentially leading to information disclosure...