WordPress Secure Copy Content Protection and Content Locking plugin < 4.1.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by [email protected] in WordPress Plugin Secure Copy Content Protection and Content Locking versions 4.1.7...

WordPress Viral Signup plugin <= 2.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Viral Signup versions = 2.1...

CVE-2024-8071

CVE-2024-8071 affects Mattermost Server versions 9.9.x ≤ 9.9.1, 9.5.x ≤ 9.5.7, 9.10.x ≤ 9.10.0, and 9.8.x ≤ 9.8.2. The issue is a failure to restrict which roles can promote a user to system admin, allowing a System Role with edit access to the permissions section of the system console to update ...

CVE-2024-42617

CVE-2024-42617 affects Pligg CMS v2.0.2 with a Cross-Site Request Forgery (CSRF) vulnerability in the admin API: /admin/admin_config.php?action=save&var_id=32. Multiple sources (including Red Hat and CNVD) corroborate the CSRF issue; an accompanying entry lists a potential PoC/exploitation path. ...

WordPress AI Engine plugin < 2.5.1 - Admin+ RCE vulnerability

Admin+ RCE vulnerability discovered by Karolis Narvilas in WordPress Plugin AI Engine versions 2.5.1...

WordPress Wordpress Simple Share Plugin plugin <= 0.5.3 - Admin+ XSS vulnerability

Admin+ XSS vulnerability discovered by Amandeep Singh Banga in WordPress Plugin Simple Share versions = 0.5.3...

CVE-2024-6158

The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high...

CVE-2024-42625

FrogCMS v0.9.5 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exploitable via the /admin/?/layout/add endpoint. The issue is documented under CVE-2024-42625 with a CVSSv3.1 base score of 8.8 ( HIGH ) per NVD. The Red Hat and PTSecurity entries corroborate the vulnerability at th...

CVE-2024-42623

FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/layout/delete/1...

CVE-2024-22121

A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability of the application...

WordPress My Sticky Bar plugin < 2.7.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin My Sticky Bar versions 2.7.2...

WordPress WP QuickLaTeX plugin < 3.8.8 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WP QuickLaTeX versions 3.8.8...

CVE-2024-6271

The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack...

WordPress Bug Library plugin < 2.1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Bug Library versions 2.1.2...

WordPress if-so plugin < 1.8.0.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin If-So Dynamic Content Personalization versions 1.8.0.4...

WordPress Secure Copy Content Protection plugin < 4.0.9 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Aryom in WordPress Plugin Secure Copy Content Protection and Content Locking versions 4.0.9...

CVE-2024-39158

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/userSysdeal.php?mudi=infoSet...

WordPress Video Widget plugin <= 1.2.3 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Bob Matyas in WordPress Plugin Video Widget versions = 1.2.3...

WordPress CSSable Countdown plugin <= 1.5 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin CSSable Countdown versions = 1.5...

WordPress Search & Replace plugin < 3.2.2 - Admin+ SQL injection vulnerability

Admin+ SQL injection vulnerability discovered by Krugov Artyom in WordPress Plugin Search & Replace versions 3.2.2...