PT-2023-31010 · Unknown · Buy Addons Bavideotab

Name of the Vulnerable Software and Affected Versions: Buy Addons bavideotab versions prior to 1.0.6 Description: The issue allows attackers to escalate privileges and obtain sensitive information via the component BaVideoTabSaveVideoModuleFrontController::run. Recommendations: For versions prior...

WordPress and WordPress plugin cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-48925

The CVE-2023-48925 entry concerns a SQL injection in Buy Addons bavideotab (PrestaShop addon) before version 1.0.6, exploitable via BaVideoTabSaveVideoModuleFrontController::run(). The vulnerability can escalate privileges and disclose sensitive information. Affected version: prior to 1.0.6. Reme...

WordPress plugin and WordPress cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin WPBakery...

CVE-2023-48925

SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive information via the component BaVideoTabSaveVideoModuleFrontController::run...

Livemesh Addons for WPBakery Page Builder < 3.6 - Contributor+ Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks...

Ultimate Addons for Contact Form 7 < 3.2.1 - Reflected Cross-Site Scripting

Description The Ultimate Addons for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

WordPress Livemesh Addons for WPBakery Page Builder Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)

Software Livemesh Addons for WPBakery Page Builder Type Plugin Vulnerable versions = 3.5 Fixed in 3.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50370 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a649ba25b310 Credits Khalid Yusuf...

WordPress Essential Addons for Elementor Pro Plugin < 5.4.9 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpdeveloper:essentialaddonsforelementor"; if description...

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Addons for Contact Form 7 Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49766 Patch priority High CVSS severity High 7.1 Developer Themefic PSID faa03e459da6 Credits RE-ALTER Required...

PT-2023-30640 · Qode Interactive · Qode Essential Addons

Name of the Vulnerable Software and Affected Versions: Qode Essential Addons versions 1.5.2 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability. This vulnerability affects Qode Interactive Qode Essential Addons, allowing for co...

CVE-2023-37868

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0...

Design/Logic Flaw

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0...

CVE-2023-37868 WordPress Premium Addons PRO Plugin <= 2.9.0 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0...

CVE-2023-37868

CVE-2023-37868 concerns WordPress Premium Addons PRO (Leap13 Premium Addons PRO). Affected: Premium Addons PRO versions up to and including 2.9.0. Description: Exposure of sensitive information to an unauthorized actor. Root cause/source indicates information disclosure vulnerability in the plugi...

WordPress Plugin Premium Addons for Elementor Information Disclosure Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...

Qode Essential Addons < 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

Description The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the installplugin function in all versions up to, and including, 1.5.2. This makes it possible for authenticated attackers, with subscriber-level acce...

PT-2023-26149 · Unknown · Leap13 Premium Addons Pro

Name of the Vulnerable Software and Affected Versions: Leap13 Premium Addons PRO versions 2.9.0 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not...

Exploit for Code Injection in Qodeinteractive Qode_Essential_Addons

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Aut...

WordPress Royal Elementor Addons And Templates Remote Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Royal Elementor Addons RCE', 'Description' = %q Exploit for the unauthenticated file upload vulnerability in WordPress Royal Elementor...