WordPress plugin XStore Core 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2024-33556: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8...

WordPress plugin XStore Core 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-33552: Improper Privilege Management

Improper Privilege Management vulnerability in 8theme XStore Core allows Privilege Escalation.This issue affects XStore Core: from n/a through 5.3.8...

PT-2024-25324 · 8Theme · 8Theme Xstore Core

Name of the Vulnerable Software and Affected Versions: 8theme XStore Core versions through 5.3.8 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the 8theme XStore Core. Recommendations: For versions through 5.3.8, update to a version later th...

XStore Core <= 5.3.5 - Unauthenticated PHP Object Injection

Description The XStore Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.5 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin...

XStore Core <= 5.3.5 - Unauthenticated SQL Injection

Description The XStore Core plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

XStore < 9.3.9 - Missing Authorization

Description The theme is vulnerable to unauthorized access due to a missing capability check on a function, allowing unauthenticated attackers to perform an unauthorized action...

XStore Core <= 5.3.5 - Authenticated (Subscriber+) Local File Inclusion

Description The XStore Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary files on the server, allowing the...

XStore < 9.3.9 - Unauthenticated Local File Inclusion

Description The theme is vulnerable to Local File Inclusion, allowing unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution...

XStore < 9.3.9 - Subscriber+ Arbitrary Options Update

Description The theme is vulnerable to unauthorized modification of data due to a missing capability check on a function, allowing authenticated attackers, with subscriber-level access and above, to update arbitrary options which can be used to achieve privilege escalation...

XStore < 9.3.9 - Missing Authorization

Description The XStore theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 9.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions...

XStore Core <= 5.3.5 - Reflected Cross-Site Scripting

Description The XStore Core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

XStore < 9.3.9 - Reflected Cross-Site Scripting

Description The theme is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an...

XStore < 9.3.9 - Unauthenticated SQLi

Description The theme is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that c...

XStore Core <= 5.3.5 - Missing Authorization

Description The XStore Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in versions up to, and including, 5.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized...

CVE-2024-33558

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5...

CVE-2024-33558

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5...

CVE-2024-33558 WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5...

CVE-2024-33558 WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5...