CVE-2024-37548

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8...

CVE-2024-37548 WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8...

CVE-2024-37548 WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Meks Meks Easy Ads Widget allows Stored XSS.This issue affects Meks Easy Ads Widget: from n/a through 2.0.8...

CVE-2024-37548

CVE-2024-37548 is an Stored XSS vulnerability in the WordPress plugin Meks Easy Ads Widget, affecting versions through 2.0.8. The vulnerability is described as Improper Neutralization of Input During Web Page Generation (XSS). Public references in the provided documents identify the plugin and af...

WordPress Google Adsense & Banner Ads by AdsforWP Plugin <= 1.9.28 is vulnerable to Cross Site Request Forgery (CSRF)

Software Google Adsense & Banner Ads by AdsforWP Type Plugin Vulnerable versions = 1.9.28 Fixed in 1.9.29 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-38751 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c7cf2e020d8d Credits...

The Stark Truth Behind the Resurgence of Russia’s Fin7

The Russia-based cybercrime group dubbed "Fin7," known for phishing and malware attacks that have cost victim organizations an estimated $3 billion in losses since 2013, was declared dead last year by U.S. authorities. But experts say Fin7 has roared back to life in 2024 -- setting up thousands o...

WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Meks Easy Ads Widget versions = 2.0.8...

WordPress Meks Easy Ads Widget Plugin <= 2.0.8 is vulnerable to Cross Site Scripting (XSS)

Software Meks Easy Ads Widget Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37548 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 06be83f3d6eb Credits Joshua Chan Required privilege...

CVE-2024-37474

Cross Site Scripting XSS vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1...

CVE-2024-37474

CVE-2024-37474 is a Cross-Site Scripting (XSS) vulnerability in Automattic Newspack Ads for WordPress, allowing Stored XSS. Affected: Newspack Ads versions from n/a up to 1.47.1. Remediation: patch/update to 1.47.1 or later as indicated by the CVE record and Wordfence entry.

CVE-2024-37474 WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1...

CVE-2024-37474 WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1...

CVE-2024-37474 WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1...

PT-2024-27583 · Automattic · Newspack Ads

Name of the Vulnerable Software and Affected Versions: Newspack Ads versions 1.47.1 and earlier Description: A Cross Site Scripting XSS issue, specifically a Stored XSS vulnerability, has been identified in Automattic Newspack Ads. This allows for malicious scripts to be stored on the server and...

WordPress plugin Newspack Ads security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.9 is vulnerable to Broken Access Control

Software Motors – Car Dealer & Classified Ads Type Plugin Vulnerable versions = 1.4.9 Fixed in 1.4.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5545 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dfa39be1a058 Credits Krzyszto...

WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Newspack Ads versions = 1.47.1...

A week in security (June 24 &#8211; June 30)

Last week on Malwarebytes Labs: TEMU sued for being "dangerous malware" by Arkansas Attorney General Driving licences and other official documents leaked by authentication service used by Uber, TikTok, X, and more "Poseidon" Mac stealer distributed via Google ads Federal Reserve "breached" data m...

WordPress Newspack Ads Plugin <= 1.47.1 is vulnerable to Cross Site Scripting (XSS)

Software Newspack Ads Type Plugin Vulnerable versions = 1.47.1 Fixed in 1.47.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37474 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b8d60e34d1ee Credits Rafie Muhammad Patchstack Required...

CVE-2024-3105

The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized...