WordPress Blocksy Companion plugin <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploads vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via SVG Uploads vulnerability discovered by wesley wcraft in WordPress Plugin Blocksy Companion versions = 2.0.45...

PT-2024-32999 · Ruijie · Ruijie Rg-Uac

Name of the Vulnerable Software and Affected Versions: Ruijie RG-UAC versions up to 20240506 Description: A critical issue was found in the software, affecting an unknown functionality of the file /view/networkConfig/RouteConfig/StaticRoute/static route edit commit.php. The manipulation of the...

CVE-2024-32990

Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability...

PT-2024-30455 · WordPress · Thim Elementor Kit

Name of the Vulnerable Software and Affected Versions: Thim Elementor Kit plugin for WordPress versions up to, and including, 1.1.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

PT-2024-25036 · Huawei · Huawei System Sharing Pop-Up Module

Name of the Vulnerable Software and Affected Versions: Huawei System Sharing Pop-Up Module affected versions not specified Description: The issue is related to an insufficient verification vulnerability in the system sharing pop-up module. Successful exploitation of this vulnerability will affect...

WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin ShortPixel Adaptive Images versions = 3.8.3...

WordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin iPages Flipbook versions = 1.5.1...

WordPress Netgsm plugin <= 2.9.32 - Broken Access Control + CSRF vulnerability

Broken Access Control + CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Netgsm versions = 2.9.32...

WordPress Social Warfare plugin <= 4.4.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Social Warfare versions = 4.4.5.1...

PT-2024-29426 · WordPress · Simple Basic Contact Form

Name of the Vulnerable Software and Affected Versions: Simple Basic Contact Form plugin for WordPress versions up to and including 20221201 Description: The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts vi...

PT-2024-22080 · WordPress · The Plus Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor plugin for WordPress versions up to, and including, 5.4.2 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Age Gate widget, allowing...

CVE-2024-34558

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in realmag777 WOLF allows Stored XSS.This issue affects WOLF: from n/a through 1.0.8.2...

CVE-2024-34570

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.3...

CVE-2024-34564

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LogicHunt Inc. Counter Up allows Stored XSS.This issue affects Counter Up: from n/a through 2.2.1...

CVE-2024-34564 WordPress Counter Up plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LogicHunt Inc. Counter Up allows Stored XSS.This issue affects Counter Up: from n/a through 2.2.1...

CVE-2024-34564

CVE-2024-34564 is a Stored XSS in Counter Up (LogicHunt Inc.) via improper input neutralization during web page generation. Affected: Counter Up versions n/a–2.2.1. Root cause is improper neutralization of input; impact is Stored XSS. Connected Red Hat advisory confirms the description. Remediati...

WordPress Mesmerize Companion plugin <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mesmerizecontactform Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Mesmerize Companion versions = 1.6.148...

WordPress plugin Counter Up 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2024-25979 · Unknown · Counter Up

Name of the Vulnerable Software and Affected Versions: Counter Up versions through 2.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can inject maliciou...

CVE-2024-4584

CVE-2024-4584 affects Faraday GM8181 and GM828x up to 20240429. The vulnerability concerns an unknown function in the /command_port.ini file that enables information disclosure and can be exploited remotely; multiple sources confirm the issue and public exploit disclosure, with vendor contact not...