CVE-2021-24910

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in the response, leading to a Reflected Cross-Si...

CVE-2021-24911

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tptranslation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack...

Cross site scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tptranslation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scriptin...

Cross site scripting

The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file...

Cross site request forgery (csrf)

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog...

CVE-2022-2377 Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog...

CVE-2022-2377 Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog...

CVE-2022-2276 WP Edit Menu < 1.5.0 - Unauthenticated Arbitrary Post Deletion

The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog...

CVE-2022-2276

CVE-2022-2276 affects the WordPress plugin WP Edit Menu (versions prior to 1.5.0). The issue is a lack of authorization and CSRF protection in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts or pages from a blog. The core impact is unauthorized post/page dele...

CVE-2022-1932 Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-Scripting

The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file...

CVE-2022-1932

The CVE-2022-1932 entry concerns the Rezgo Online Booking WordPress plugin, prior to version 4.1.8, which fails to sanitize and escape certain parameters when outputting them to a page. This leads to a Reflected Cross-Site Scripting (XSS) vulnerability that can be triggered via a Local File Inclu...

CVE-2021-24911 Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tptranslation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack...

CVE-2021-24910 Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in the response, leading to a Reflected Cross-Si...

MAL-2022-1046 Malicious code in apiiitrueid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fc3c255dfb4f95180eedfe593a9e58016cc8cda601b8bbbf2d48f01e61e0f8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-16315 · Autonami · Abandoned Cart Recovery For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin versions prior to 2.1.2 Description: The issue concerns a lack of authorization and CSRF checks in one of th...

MAL-2022-4653 Malicious code in mobx-model-xd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd03fd58f7b83df1b36fd97189d6768e243699870898f9f1ea1dad8f0bb3383d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6555 Malicious code in thischingunique (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9cedeae9eb258fd7ce8e9a21395c4ca34d7a62c23cd0c556caf22aaaf057f820 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2614 Malicious code in duplex-child-orocess (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d80c9a50168c6e1e994ec5162bc0269e152ff4c19a7341943ecde6cd1574a2ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7119 Malicious code in wexack-node-externals (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280fed3d8637aa96a9752d788f7ffb037922023a05290834a384a70021b85361 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7371 Malicious code in yunt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3aa9c27f49a09a1e4a0d4f23d17e31216f8f8a3d406ac40992ed96e71ce657df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...