CVE-2024-13681

CVE-2024-13681 affects the WordPress theme Uncode. The vulnerability is an unauthenticated arbitrary file read due to insufficient input validation in the uncode_admin_get_oembed function, affecting all versions up to 2.9.1.6. Patch/mitigation: upgrade to Uncode 2.9.1.6 or apply the vendor fix th...

PT-2025-6592

Name of the Vulnerable Software and Affected Versions Uncode theme for WordPress versions up to, and including, 2.9.1.6 Description The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers wit...

PT-2025-6594

Name of the Vulnerable Software and Affected Versions Uncode theme for WordPress versions up to, and including, 2.9.1.6 Description The issue is related to insufficient input validation in the uncode admin get oembed function, allowing unauthenticated attackers to read arbitrary files on the...

PT-2025-6597

Name of the Vulnerable Software and Affected Versions Uncode Core plugin for WordPress versions up to, and including, 2.9.1.6 Description The issue allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes due to the software not properly validating a...

PT-2025-6598

Name of the Vulnerable Software and Affected Versions Uncode theme for WordPress versions up to, and including, 2.9.1.6 Description The issue is related to insufficient input validation in the uncode recordMedia function, allowing authenticated attackers with Subscriber-level access and above to...

WordPress plugin Uncode Core 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress plugin Uncode 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation...

WordPress plugin Uncode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Uncode 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation...

CVE-2024-13691: Improper Input Validation

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncoderecordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary...

CVE-2024-13681: Improper Input Validation

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncodeadmingetoembed' function in all versions up to, and including, 2.9.1.6. This makes it possible for unauthenticated attackers to read arbitrary files on the server...

CVE-2024-13667: Improper Neutralization of Input During Web Page Generation

The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-13689: Improper Control of Generation of Code

The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

WordPress Uncode theme <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia vulnerability

Authenticated Subscriber+ Arbitrary File Read in uncoderecordMedia vulnerability discovered by mikemyers in WordPress Theme Uncode versions = 2.9.1.6...

WordPress Uncode Core plugin <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution in uncodegetmedias vulnerability discovered by mikemyers in WordPress Plugin Uncode Core versions = 2.9.1.6...

WordPress Uncode theme <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via mle-description vulnerability discovered by mikemyers in WordPress Theme Uncode versions = 2.9.1.6...

WordPress Uncode plugin <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed vulnerability

Unauthenticated Arbitrary File Read in uncodeadmingetoembed vulnerability discovered by mikemyers in WordPress Theme Uncode versions = 2.9.1.6...

CVE-2023-51500

Missing Authorization vulnerability in Undsgn Uncode Core.This issue affects Uncode Core: from n/a through 2.8.8...

CVE-2023-51500 WordPress Uncode Core plugin <= 2.8.8 - Arbitrary File Deletion vulnerability

Missing Authorization vulnerability in Undsgn Uncode Core.This issue affects Uncode Core: from n/a through 2.8.8...

CVE-2023-51500 WordPress Uncode Core plugin <= 2.8.8 - Arbitrary File Deletion vulnerability

Missing Authorization vulnerability in Undsgn Uncode Core.This issue affects Uncode Core: from n/a through 2.8.8...