CVE-2024-8968 MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color

The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisit...

WordPress Kadence Blocks plugin < 3.2.54 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions 3.2.54...

CVE-2024-9881 LearnPress < 4.2.7.2 - Admin+ Stored XSS

The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Fluent Forms plugin < 5.2.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin FluentForm versions 5.2.1...

CVE-2024-10551 Sticky Social Icons <= 1.2.1 - Admin+ Stored XSS

The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress MailPoet plugin < 5.3.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin MailPoet versions 5.3.2...

WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability

Admin+ Remote Code Execution RCE vulnerability discovered by Hakiduck Patchstack Alliance in WordPress Plugin Podlove Podcast Publisher versions = 4.1.15...

PT-2024-32431 · F5 · Big-Iq

Name of the Vulnerable Software and Affected Versions: BIG-IQ versions prior to 8.2.0.1 BIG-IQ versions prior to 8.3.0 Description: A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility. This issue allows an attacker with the Administrat...

WordPress Appointment Booking Calendar plugin <= 1.6.7.53 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Jeewan Kumar Bhatta in WordPress Plugin Simply Schedule Appointments versions = 1.6.7.53...

ViciDial 2.0.5 Cross Site Request Forgery

============================================================================================================================================= | Title : ViciDial Call Center - astguiclient - thirtieth public release 2.0.5 CSRF Add ADmin Vulnerability | | Author : indoushka | | Tested on : windows ...

WordPress Slider by 10Web plugin < 1.2.59 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Slider by 10Web versions 1.2.59...

WordPress WP ULike plugin < 4.7.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WP ULike versions 4.7.4...

Online Flight Booking System 1.0 Cross Site Request Forgery

============================================================================================================================================================================= | Title : Online Flight Booking System 1.0 CSRF Add Admin vulnerability | | Author : indoushka | | Tested on : windows 10...

FrogCms 安全漏洞

FrogCms is an HTTP server by philippe personal developer. A security vulnerability exists in FrogCMS version 0.9.5, which stems from a cross-site request forgery vulnerability in /admin/? A cross-site request forgery vulnerability exists in /user/add...

WordPress NinjaTeam Header Footer Custom Code plugin < 1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Takshal Patel in WordPress Plugin NinjaTeam Header Footer Custom Code versions 1.2...

WordPress GS Logo Slider Lite plugin < 3.6.9 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin GS Logo Slider versions 3.6.9...

WordPress EventON plugin < 2.2.17 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Wesley "dk4trin" Santos in WordPress Plugin EventON versions 2.2.17...

PT-2024-37950 · WordPress · Eventon

Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 2.2.17 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks by injecting malicious scripts, even when unfiltered html is disallowed. This is due...

PT-2024-37905 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the WP MultiTasking WordPress plugin. This could allow attackers to make a logged-in admin...

WordPress LifterLMS plugin <= 7.7.5 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by FKSEC in WordPress Plugin LifterLMS versions = 7.7.5...