WordPress Sassy social share plugin < 3.3.63 - Admin+ Stored Cross-Site scripting vulnerability

Admin+ Stored Cross-Site scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Sassy Social Share versions 3.3.63...

WordPress ArForms Premium plugin < 6.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin ARForms versions 6.6...

WordPress Google CSE plugin <= 1.0.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Google CSE versions = 1.0.7...

CVE-2024-36549

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/vpsCompanydeal.php?mudi=rev&nohrefStr=close...

WordPress KKProgressbar2 Free plugin <= 1.1.4.2 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Bob Matyas in WordPress Plugin KKProgressbar2 Free versions = 1.1.4.2...

WordPress Flattr plugin <= 1.2.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Flattr versions = 1.2.2...

WordPress Sailthru Triggermail plugin <= 1.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Sailthru Triggermail versions = 1.1...

WordPress WP Backpack plugin <= 2.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WP Backpack versions = 2.1...

WordPress EasyEvent plugin <= 1.0.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Satyam Singh, Vibhor Sharma in WordPress Plugin EasyEvent versions = 1.0.0...

WordPress BackUpWordPress plugin <= 3.13 - Authenticated (Admin+) Directory Traversal vulnerability

Authenticated Admin+ Directory Traversal vulnerability discovered by dk0pf - Plumeria Lab in WordPress Plugin BackUpWordPress versions = 3.13...

WordPress AGCA – Custom Dashboard & Login Page plugin < 7.2.2 - Admin+ Stored XSS via Image URL vulnerability

Admin+ Stored XSS via Image URL vulnerability discovered by Dikshita Trivedi Cybersecdexter in WordPress Plugin Absolutely Glamorous Custom Admin versions 7.2.2...

Save as PDF < 3.2.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. On the "Settings Save as PDF Basic...

WordPress WP Staging < 3.4.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin WP STAGING – Backup Duplicator & Migration versions 3.4.0...

CVE-2024-1219 Easy Social Feed < 6.5.6 - Contributor+ Stored XSS

The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

EasyEvent <= 1.0.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed 1. Got to https://example.com/wp-admin/options-general.php?page=easyevent 2. In the ID fiel...

WordPress NPS computy plugin < 2.7.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin NPS computy versions 2.7.6...

WordPress Fancy Product Designer plugin < 6.1.81 - Admin+ Cross Site Scripting via Product Title vulnerability

Admin+ Cross Site Scripting via Product Title vulnerability discovered by Bob Matyas in WordPress Plugin Fancy Product Designer versions 6.1.81...

WordPress Carousel, Slider, Gallery by WP Carousel plugin <= 2.6.3 - Admin+ PHP Object Injection vulnerability

Admin+ PHP Object Injection vulnerability discovered by hoanpk in WordPress Plugin Carousel, Slider, Gallery by WP Carousel versions = 2.6.3...

VulnCheck KEV: CVE-2024-31281

Missing Authorization vulnerability in andymoyle Church Admin church-admin.This issue affects Church Admin: from n/a through = 4.1.6...

VulnCheck KEV: CVE-2024-30244

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in andymoyle Church Admin church-admin.This issue affects Church Admin: from n/a through = 4.0.27...