Simple Online Bidding System Code Issue Vulnerability

Simple Online Bidding System is an online bidding system by oretnom23 individual developers. A code issue vulnerability exists in SourceCodester Simple Online Bidding System version 1.0, which stems from the parameter img in the file /admin/ajax.php?action=savesettings that can lead to unrestrict...

PT-2024-37465

Name of the Vulnerable Software and Affected Versions: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions 1.1.5 and earlier The Booking for Appointments and Events Calendar – Amelia plugin for WordPress Pro version 7.5.1 and earlier Description: The issue is...

CVE-2024-6225: Improper Neutralization of Input During Web Page Generation

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.5 and 7.5.1 for the Pro version due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2024-4474: Cross-Site Request Forgery (CSRF)

The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2023-6495

The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-14973

Name of the Vulnerable Software and Affected Versions YARPP – Yet Another Related Posts Plugin versions up to and including 5.30.9 Description The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticat...

CVE-2023-6495: Improper Neutralization of Input During Web Page Generation

The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-4480

The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress plugin WP Prayer II security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Carbon Forum 5.9.0 - Stored XSS Vulnerability

Exploit Title: Persistent XSS in Carbon Forum 5.9.0 Stored Exploit Author: Chokri Hammedi Vendor Homepage: https://www.94cb.com/ Software Link: https://github.com/lincanbin/Carbon-Forum Version: 5.9.0 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent stored XSS vulnerability was...

CVE-2024-3971: Cross-Site Request Forgery (CSRF)

The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack...

CVE-2024-3965: Cross-Site Request Forgery (CSRF)

The Pray For Me WordPress plugin through 1.0.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Carbon Forum 5.9.0 - Stored XSS

Exploit Title: Persistent XSS in Carbon Forum 5.9.0 Stored Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.94cb.com/ Software Link: https://github.com/lincanbin/Carbon-Forum Version: 5.9.0 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent stored XSS...

CVE-2024-0653

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-0653: Improper Neutralization of Input During Web Page Generation

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2024-15720

Name of the Vulnerable Software and Affected Versions Custom Field Template plugin for WordPress versions up to, and including, 2.6.1 Description The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

CVE-2024-4942

The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2024-4942: Improper Neutralization of Input During Web Page Generation

The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

Frontend Checklist <= 2.3.2 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to frontend-checklist admin...

PT-2024-33530 · WordPress · Custom Dash

Name of the Vulnerable Software and Affected Versions: Custom Dash plugin for WordPress version 1.0.2 and earlier Description: The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This make...