WordPress News Ticker plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin News Ticker versions = 1.0...

PT-2024-16658 · Guangzhou Tuchuang Computer Software Development · Interlib Library Cluster Automation Management System

Name of the Vulnerable Software and Affected Versions: Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System versions up to 2.0.1 Description: A critical vulnerability was found in the software, affecting unknown code of the file...

CVE-2024-50523

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through 1.7.3...

WordPress aThemes Addons for Elementor plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Yusuf Patchstack Alliance in WordPress Plugin aThemes Addons for Elementor versions = 1.0.7...

WordPress SKSDEV Toolkit plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin SKSDEV Toolkit versions = 1.0.0...

WordPress DataMentor plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Plugin DataMentor versions = 1.7...

WordPress Ancient World Linked Data plugin <= 0.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Zlrqh Patchstack Alliance in WordPress Plugin Ancient World Linked Data versions = 0.2.1...

PT-2024-16218 · WordPress · Move Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Move Addons for Elementor plugin for WordPress versions up to, and including, 1.3.5 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft template data v...

WordPress Wux Blog Editor plugin <= 3.0.0 - Authentication Bypass to Administrator vulnerability

Authentication Bypass to Administrator vulnerability discovered by István Márton in WordPress Plugin Wux Blog Editor versions = 3.0.0...

CVE-2022-30357

OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required...

WordPress Rover IDX plugin <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator vulnerability

Authenticated Subscriber+ Authentication Bypass to Administrator vulnerability discovered by István Márton in WordPress Plugin Rover IDX versions = 3.0.0.2905...

CVE-2024-9425

The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adtaximage shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-47637

: Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through 6.4.1...

PT-2024-39513 · WordPress · Redi Restaurant Reservation

Name of the Vulnerable Software and Affected Versions: ReDi Restaurant Reservation plugin for WordPress versions up to, and including, 24.0902 Description: The ReDi Restaurant Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without...

WordPress Job Board Manager for WordPress plugin <= 1.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Job Board Manager for WordPress versions = 1.0...

WordPress Zoho CRM Lead Magnet plugin <= 1.7.9.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin Zoho CRM Lead Magnet versions = 1.7.9.7...

WordPress Crazy Call To Action Box plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Crazy Call To Action Box versions = 1.0.5...

CVE-2024-9904

A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely...

WordPress pretix widget plugin <= 1.0.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin pretix widget versions = 1.0.5...

WordPress plugin DethemeKit For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...