WordPress Just Writing Statistics plugin <= 4.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by l8BL Patchstack Alliance in WordPress Plugin Just Writing Statistics versions = 4.7...

AZL-54692 CVE-2024-56738 affecting package grub2 2.06-16

GNU GRUB aka GRUB2 through 2.12 does not use a constant-time algorithm for grubcryptomemcmp and thus allows side-channel attacks...

PT-2024-17438 · WordPress · Bitcoin Lightning Publisher

Name of the Vulnerable Software and Affected Versions: Bitcoin Lightning Publisher for WordPress versions up to, and including, 1.4.1 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

WordPress shMapper by Teplitsa plugin <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin ShMapper by Teplitsa versions = 1.4.18...

CVE-2024-12331 File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajaxinstallplugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2024-55984 WordPress Saksh Escrow System plugin <= 2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in susheelhbti Saksh Escrow System saksh-escrow-system allows SQL Injection.This issue affects Saksh Escrow System: from n/a through = 2.4...

CVE-2024-55985 WordPress YDS Support Ticket System plugin <= 1.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ydesignservices YDS Support Ticket System yds-support-ticket-system allows SQL Injection.This issue affects YDS Support Ticket System: from n/a through = 1.0...

CVE-2024-54434

Cross-Site Request Forgery CSRF vulnerability in BenJemin phZoom phzoom allows Stored XSS.This issue affects phZoom: from n/a through = 1.2.92...

CVE-2024-54406 WordPress Comments On Feed plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Reza Moallemi Comments On Feed allows Reflected XSS.This issue affects Comments On Feed: from n/a through 1.2.1...

CVE-2024-54421 WordPress Floating Video Player plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Sanjay Singh Negi Floating Video Player allows Stored XSS.This issue affects Floating Video Player: from n/a through 1.0...

PT-2024-36295 · Unknown · Youtube Video Grid

Name of the Vulnerable Software and Affected Versions: Jake H. Youtube Video Grid versions n/a through 1.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which can be exploited due to incorrectly configured access control security levels. This allows for the...

WordPress افزونه پیامک ووکامرس Persian WooCommerce SMS plugin <= 7.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by minhtuanact Patchstack Alliance in WordPress Plugin Persian Woocommerce SMS versions = 7.0.5...

WordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin AIcomments versions = 1.4.1...

CVE-2023-32094

Missing Authorization vulnerability in Felix W. Extended Post Status extended-post-status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through = 1.0.19...

CVE-2023-29433

Missing Authorization vulnerability in carsonxu tencentcloud-cos tencentcloud-cos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects tencentcloud-cos: from n/a through = 1.0.7...

CVE-2023-25966 WordPress FileBird plugin <= 5.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through = 5.1.4...

WordPress Easy Replace plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Easy Replace versions = 1.3...

CVE-2024-53810 WordPress Simple User Registration plugin <= 5.5 - Broken Access Control on User Deletion vulnerability

Missing Authorization vulnerability in N-Media Simple User Registration wp-registration allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Simple User Registration: from n/a through = 5.5...

WordPress Pubnews theme <= 1.0.7 - Unauthenticated Arbitrary Plugin Installation vulnerability

Unauthenticated Arbitrary Plugin Installation vulnerability discovered by Kevin Murphy knmurphy in WordPress Theme Pubnews versions = 1.0.7...

WordPress Spectra plugin <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Team Widget vulnerability discovered by zer0gh0st in WordPress Plugin Spectra versions = 2.16.2...