WordPress plugin WordPress Backup & Migration security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Xpro Elementor Addons plugin <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by stealthcopter in WordPress Plugin Xpro Elementor Addons versions = 1.4.3...

WordPress plugin Xpro Elementor Addons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-25986 · WordPress · Xpro Elementor Addons

Name of the Vulnerable Software and Affected Versions: Xpro Elementor Addons versions 1.4.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This can be exploited by attackers...

PT-2024-18404 · WordPress · The Grid Gallery

Name of the Vulnerable Software and Affected Versions: The Grid Gallery – Photo Image Grid Gallery plugin for WordPress versions up to, and including, 1.4.3 Description: The issue allows authenticated attackers with contributor access and above to inject a PHP Object via deserialization of...

WordPress Plugin Backup Migration 日志信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A log information...

PT-2024-24772 · Unknown · Inisev Backup Migration

Name of the Vulnerable Software and Affected Versions: Inisev Backup Migration versions n/a through 1.4.3 Description: The issue is related to the insertion of sensitive information into log files. This can potentially expose confidential data. Recommendations: For versions n/a through 1.4.3,...

WordPress Backup Migration Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure

Software Backup Migration Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-32686 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 6f8f6222b4f0 Credits emad...

Legal Pages < 1.4.3 - Cross-Site Request Forgery

Description The Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the uninstallreasonsubmission function. This makes it possible for unauthenticated attackers to submit an...

WordPress Legal Pages Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Legal Pages Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32451 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4f155bb44624 Credits Dhabaleshwar Das Requir...

CVE-2024-2954

The Action Network plugin for WordPress is vulnerable to SQL Injection via the 'bulk-action' parameter in version 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wit...

Out-of-bounds

dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive,...

Element Android Security Vulnerability

Element Android is the Android Matrix client provided by Element. A security vulnerability exists in Element Android versions 1.4.3 through 1.6.10, which stems from the presence of an Intent redirection vulnerability that allows a third-party malicious application to initiate internal activity by...

CVE-2024-23820 OpenFGA DoS

OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to ListObjects may not release memory properly. So when a sufficiently high number of those calls are executed, t...

CVE-2023-52204

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Javik Randomize.This issue affects Randomize: from n/a through 1.4.3...

CVE-2023-52204 WordPress Randomize Plugin <= 1.4.3 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Javik Randomize.This issue affects Randomize: from n/a through 1.4.3...

PT-2024-14116 · WordPress · Wp Optin Wheel

Name of the Vulnerable Software and Affected Versions: WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce versions 1.4.3 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This affects the WP Optin Wheel...

CVE-2023-52126

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a through 1.4.3...

WordPress WordPress Backup & Migration Plugin <= 1.4.3 is vulnerable to Broken Access Control

Software WordPress Backup & Migration Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52183 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID e20ae588b69a Credits Abdi Pranata...

WordPress Event Management Tickets Booking Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Event Management Tickets Booking Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47525 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID da5590e03010 Credits Jeongwoo-LeeRoronoa...