WordPress Contact Form Widget plugin <= 1.4.2 - CSRF vulnerability

CSRF vulnerability discovered by Abdi Pranata in WordPress Plugin Contact Form Widget versions = 1.4.2...

WordPress SB Random Posts Widget plugin <= 1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin SB Random Posts Widget versions = 1.0...

Malicious code in customer-feedback-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf15dcf2318155d18aee75e77887bfe0709b51548def3d5e5906527670e25631 The OpenSSF Package Analysis project identified 'customer-feedback-widget' @ 1.5.8 npm as malicious. It is considered malicious because: - The...

MAL-2024-9112 Malicious code in customer-feedback-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf15dcf2318155d18aee75e77887bfe0709b51548def3d5e5906527670e25631 The OpenSSF Package Analysis project identified 'customer-feedback-widget' @ 1.5.8 npm as malicious. It is considered malicious because: - The...

WordPress Restaurant Reservations Widget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Restaurant Reservations Widget versions = 1.0...

WordPress SB Random Posts Widget Plugin <= 1.0 is vulnerable to Local File Inclusion

Software SB Random Posts Widget Type Plugin Vulnerable versions = 1.0 Fixed in 1.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-48029 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 4e7fd324ea44 Credits João Pedro S Alcântara Kinorth Required...

WordPress pretix widget Plugin <= 1.0.5 is vulnerable to Local File Inclusion

Software pretix widget Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.6 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2024-9575 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 3a2933f81cf6 Credits João Pedro S Alcântara Kinorth Required...

WordPress Contact Form Widget Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Contact Form Widget Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-48037 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5cb5ac9f9e50 Credits Abdi Pranata...

WordPress plugin Pretix Widget has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-39696

Name of the Vulnerable Software and Affected Versions pretix Widget WordPress plugin versions 1.0.0 through 1.0.5 Description The issue is a Local File Inclusion vulnerability in the pretix Widget WordPress plugin, which affects the plugin on Windows and allows PHP Local File Inclusion. This...

CVE-2024-9575: Improper Limitation of a Pathname to a Restricted Directory

Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5...

WordPress Restaurant Reservations Widget Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Restaurant Reservations Widget Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48023 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f10452fd1d3d Credits Mika Required privile...

WordPress Custom Twitter Feeds plugin < 2.2.3 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Custom Twitter Feeds Tweets Widget versions 2.2.3...

WordPress Royal Elementor Addons and Templates plugin <= 1.3.986 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Team Member Widget vulnerability discovered by Webbernaut in WordPress Plugin Royal Elementor Addons versions = 1.3.986...

CVE-2024-47817 Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes for the lara-zeus ecosystem. If values passed to a paragraph widget are not valid and contain a specific set of characters, applications a...

CVE-2024-47817 Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes for the lara-zeus ecosystem. If values passed to a paragraph widget are not valid and contain a specific set of characters, applications a...

CVE-2024-47817

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes for the lara-zeus ecosystem. If values passed to a paragraph widget are not valid and contain a specific set of characters, applications a...

Cross-site Scripting (XSS)

Overview limesurvey/limesurvey is a FOSS online survey tool on the web. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input validation and output encoding in the Alert Widget's message component. Note: This is fixed in 6.5.0+240319. Details Cross-sit...

LimeSurvey Cross Site Scripting vulnerability

Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component...

GHSA-632Q-77QJ-C89Q LimeSurvey Cross Site Scripting vulnerability

Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component...