CVE-2019-25143 GDPR Cookie Compliance <= 4.0.2 - Missing Authorization

The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdprcookiecomplianceresetsettings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings...

CVE-2021-4361 JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearchjobintegrationssettinsave AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on...

CVE-2021-4361

CVE-2021-4361 affects the WordPress plugin JobSearch WP Job Board. The vulnerability is an authorization bypass caused by a missing capability check on the AJAX action jobsearch_job_integrations_settin_save in versions up to and including 1.8.1. This allows authenticated attackers to update arbit...

CVE-2021-4362

The CVE-2021-4362 issue affects the Kiwi Social Share plugin for WordPress (version 2.1.0). The vulnerability is an authorization bypass caused by a missing capability check in the kiwi_social_share_get_option() function invoked via the kiwi_social_share_get_option AJAX action, allowing unauthent...

CVE-2021-4361 JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearchjobintegrationssettinsave AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on...

CVE-2021-4351 Frontend File Manager <= 18.2 - Unauthenticated Post Meta Change

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfmfilemetaupdate AJAX action. This makes it possible for...

CVE-2020-36704 Fruitful < 3.8.2 - Stored Cross-Site Scripting

The Fruitful Theme for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters stored via the fruitfulthemeoptionsaction AJAX action in versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2020-36704

CVE-2020-36704 (WordPress Fruitful Theme) is a stored XSS vulnerability affecting versions up to and including 3.8.1. The issue arises from insufficient input sanitization and output escaping in parameters stored via the fruitful_theme_options_action AJAX action. Exploitation requires authenticat...

CVE-2021-4350 Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emails

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfmsendfileinemail AJAX action. This makes it possible for unauthenticated attackers to send emails usin...

CVE-2021-4346 uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes

The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing login checks on the stmlistingprofileedit AJAX action. This makes it possible for unauthenticated attackers to edit any account on the blog,...

CVE-2021-4343

The CVE-2021-4343 entry refers to the WordPress Unauthenticated Account Creation plugin (up to version 1.6.6). The underlying issue is that the stm_listing_register AJAX action is accessible and unprotected, allowing unauthenticated attackers to create accounts, including administrator-level acco...

PT-2023-12480 · WordPress · Frontend File Manager

Name of the Vulnerable Software and Affected Versions: Frontend File Manager plugin for WordPress versions up to, and including, 18.2 Description: The issue arises from lacking authorization protections, checks against users editing other's posts, and a missing security nonce on the "wpfm edit fi...

PT-2023-12473 · WordPress · Kiwi Social Share

Name of the Vulnerable Software and Affected Versions: Kiwi Social Share plugin for WordPress version 2.1.0 Description: The issue is related to an authorization bypass due to a missing capability check on the kiwi social share get option function, which is called via the "kiwi social share get...

PT-2023-12455 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue is related to missing login checks on the stm listing profile edit AJAX action, allowing unauthenticated attackers to edit any account on the blog. This...

PT-2023-12471 · WordPress · Jobsearch Wp Job Board

Name of the Vulnerable Software and Affected Versions: JobSearch WP Job Board plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to authorization bypass due to a missing capability check on the jobsearch job integrations settin save AJAX action. This allow...

WordPress Plugin Page Builder: KingComposer 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-12447 · WordPress · Unauthenticated Account Creation

Name of the Vulnerable Software and Affected Versions: Unauthenticated Account Creation plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows unauthenticated attackers to create accounts, including those with administrator privileges, due to the stm listing...

PT-2023-12459 · WordPress · Frontend File Manager

Name of the Vulnerable Software and Affected Versions: Frontend File Manager plugin for WordPress versions up to, and including, 18.2 Description: The issue is related to Unauthenticated HTML Injection due to lacking authentication protections on the wpfm send file in email AJAX action. This allo...

CVE-2023-34111

The Release PR Merged workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of $ github.event.pullrequest.title in a bash command within the GitHub...

Command injection

The Release PR Merged workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerability which allows for arbitrary code execution within the github action context due to the insecure usage of $ github.event.pullrequest.title in a bash command within the GitHub...