2734 matches found
WordPress Charity Addon for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Charity Addon for Elementor versions = 1.3.0...
WordPress Medical Addon for Elementor plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Medical Addon for Elementor versions = 1.6.4...
WordPress Medical Addon for Elementor Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)
Software Medical Addon for Elementor Type Plugin Vulnerable versions = 1.6.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44024 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2feb17bc52f9 Credits João Pedro S Alcântara Kinor...
PT-2024-39067 · WordPress · Themesflat Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Themesflat Addons For Elementor plugin for WordPress versions up to, and including, 2.2.1 Description: The issue is related to Stored Cross-Site Scripting XSS due to insufficient input sanitization and output escaping on URL attributes in...
WordPress Charity Addon for Elementor Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)
Software Charity Addon for Elementor Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44026 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8bb1c1474af8 Credits João Pedro S Alcântara...
WordPress Gum Elementor Addon Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)
Software Gum Elementor Addon Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44027 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID deeeb1b651c5 Credits João Pedro S Alcântara Kinorth...
PT-2024-12112
Name of the Vulnerable Software and Affected Versions CS-Cart MultiVendor version 4.16.1 Description A Directory Traversal vulnerability allows remote attackers to run arbitrary code via a crafted zip file when installing a new add-on. This issue enables attackers to potentially execute malicious...
WordPress Restaurant & Cafe Addon for Elementor Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS)
Software Restaurant & Cafe Addon for Elementor Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44032 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fe8ab7d9930f Credits João Pedro S...
WordPress Gum Elementor Addon plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by ghsinfosec Patchstack Alliance in WordPress Plugin Gum Elementor Addon versions = 1.3.7...
WordPress Gum Elementor Addon Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)
Software Gum Elementor Addon Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44035 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 73298ffb7a63 Credits ghsinfosec Required privilege...
CVE-2024-8742
CVE-2024-8742 affects the WordPress plugin Essential Addons for Elementor (vulnerable up to and including 6.0.3). The issue is a Stored Cross-Site Scripting in the Filterable Gallery widget caused by insufficient input sanitization and output escaping. Exploitation requires an authenticated user ...
CVE-2023-2919
The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addonenabledisable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a...
CVE-2023-2919
The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addonenabledisable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a...
WordPress Tutor LMS plugin <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' vulnerability
Cross-Site Request Forgery via 'addonenabledisable' vulnerability discovered by Ram in WordPress Plugin Tutor LMS versions = 2.7.4...
PT-2024-12208 · WordPress · Tutor Lms
Name of the Vulnerable Software and Affected Versions: Tutor LMS plugin for WordPress versions up to, and including, 2.7.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the addon enable disable function. This allows unauthenticated...
CVE-2024-8292
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...
CVE-2024-8292
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...
CVE-2024-8292 WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...
CVE-2024-8292 WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...