pb-cms security vulnerabilities

pb-cms waterfall content management system is a content management system by LinZhaoguan Personal Developer. A security vulnerability exists in pb-cms version v.2.0. A remote attacker can exploit the vulnerability to execute arbitrary code via the theme management feature...

WordPress plugin PostLists has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-54731

cpdf through 2.8 allows stack consumption via a crafted PDF document...

CPDF security vulnerabilities

CPDF is a PDF command line tool from the individual developer John Whitington. A security vulnerability exists in CPDF 2.8 and earlier versions, which stems from allowing the use of a stack through a carefully crafted PDF document...

WordPress plugin Auto iFrame has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Modula Image Gallery plugin <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by SavPhill Savphill in WordPress Plugin Modula Image Gallery versions = 2.11.10...

WordPress Content Blocks Builder plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Caesar Evan Santoso Patchstack Alliance in WordPress Plugin Content Blocks Builder versions = 2.7.6...

WordPress Sell Digital Downloads plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Sell Digital Downloads versions = 2.2.7...

WordPress Custom DataBase Tables Plugin <= 2.1.34 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Custom DataBase Tables versions = 2.1.34...

WordPress Multiple Carousel Plugin <= 2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Multiple Carousel versions = 2.0...

WordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Featured Page Widget versions = 2.2...

CVE-2024-56300

CVE-2024-56300 affects WPSpins Post/Page Copying Tool (WordPress). Insertion of Sensitive Information Into Sent Data allows retrieval of embedded sensitive data. Affected: Post/Page Copying Tool versions from n/a through 2.0.0. The CVE entry is linked to Red Hat and Wordfence entries with the sam...

CVE-2024-11606

The Tabs Shortcode WordPress plugin (through version 2.0.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue arises because the plugin fails to properly validate and escape certain shortcode attributes before outputting them back onto a page or post. This flaw could be exploited by...

CVE-2024-12383 Binary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'bmwdisplaypvsetpage' function and insufficient input sanitization and output escaping of the...

PT-2025-1747 · Unknown · Ars Affiliate Page Plugin

Name of the Vulnerable Software and Affected Versions: ARS Affiliate Page Plugin versions up to, and including, 2.0.2 Description: The issue is related to Reflected Cross-Site Scripting via the utm keyword parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-1729 · WordPress · Wp Menu Image

Name of the Vulnerable Software and Affected Versions: WP Menu Image plugin for WordPress versions up to, and including, 2.2 Description: The issue is related to a missing capability check on the wmi delete img menu function, which allows unauthenticated attackers to delete images from menus. Thi...

WordPress plugin Highlight: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin ClickWhale has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress plugin Bootstrap Blocks for WP Editor: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Sell Media has a cross-site scripting vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...