7422 matches found
WordPress Premium Addons for Elementor plugin <= 4.5.1 - Arbitrary Blog Option Update vulnerability
Arbitrary Blog Option Update vulnerability discovered by WPScanTeam in WordPress Premium Addons for Elementor plugin versions = 4.5.1. Solution Update the WordPress Premium Addons for Elementor plugin to the latest available version at least 4.5.2...
CVE-2021-33199
CVE-2021-33199 affects Expression Engine prior to 6.0.3. The vulnerability resides in addonIcon in Addons/file/mod.file.php, which uses the untrusted input value input->get('file') instead of the fixed file names icon.png and icon.svg. This results in input validation issues with the addonIcon...
CVE-2021-33199
In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input-get'file' instead of the fixed file names of icon.png and icon.svg...
Unspecified Vulnerability in Plus Addons for Elementor Page Builder WordPress plugin
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the Plus Addons for Elementor Page Builder WordPress plugin prior...
Unspecified vulnerability in Plus Addons for Elementor Page Builder WordPress plugin (CNVD-2021-44293)
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in Plus Addons for Elementor Page Builder WordPress plugin versions...
CVE-2021-24351
The theplusmorepost AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting exploitable on both unauthenticated and authenticated users...
CVE-2021-24358
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue...
CVE-2021-24351
The theplusmorepost AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting exploitable on both unauthenticated and authenticated users...
CVE-2021-24351
The theplusmorepost AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting exploitable on both unauthenticated and authenticated users...
CVE-2021-24358
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue...
CVE-2021-24359 The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could b...
CVE-2021-24358
WordPress Plus Addons for Elementor Page Builder prior to 4.1.10 is vulnerable to an Open Redirect when a crafted URL is used to pass an unvalidated redirect parameter. The issue arises from failing to validate the redirect target before redirecting, enabling potential abuse for phishing or to le...
CVE-2021-24358 The Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue...
CVE-2021-24351 The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS)
The theplusmorepost AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting exploitable on both unauthenticated and authenticated users...
CVE-2021-24351
The CVE-2021-24351 entry corresponds to a reflected Cross-Site Scripting vulnerability in WordPress The Plus Addons for Elementor Page Builder plugin, affecting versions before 4.1.12. The issue arises in the theplus_more_post AJAX action, where some fields are not properly sanitized, allowing un...
WordPress plugin Plus Addons for Elementor Page Builder 授权问题漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in Plus Addons for Elementor Page Builder WordPress plugin versions...
PT-2021-15895 · WordPress · The Plus Addons For Elementor Page Builder
Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder WordPress plugin versions prior to 4.1.11 Description: The issue allows an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site, as the plugin did n...
Plus Addons for Elementor Page Builder WordPress plugin 输入验证错误漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the Plus Addons for Elementor Page Builder WordPress plugin prior...
Elementor Page Builder WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in Elementor Page Builder WordPress, which stems from a...
SUSE: Security Advisory (SUSE-SU-2016:3080-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...