WordPress Ajax Search Lite plugin < 4.12.5 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ajax Search Lite versions 4.12.5...

CVE-2024-13585

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13585

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13585

CVE-2024-13585 — Ajax Search Lite (WordPress) Affected: Ajax Search Lite WordPress plugin, versions prior to 4.12.5 (i.e.,

CVE-2024-13585 Ajax Search Lite < 4.12.5 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13585 Ajax Search Lite < 4.12.5 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-7501 · WordPress · Event Tickets/Registration

Name of the Vulnerable Software and Affected Versions: Event Tickets and Registration plugin for WordPress versions up to, and including, 5.19.1.1 Description: The issue is related to a missing capability check on the ajax ticket delete function, allowing authenticated attackers with...

WordPress plugin Ajax Search Lite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Exploit for CVE-2024-2961

PHP file-read to RCE CVE-2024-2961 TODO Parse LIBC to kn...

CVE-2024-13476

CVE-2024-13476 concerns the LTL Freight Quotes – GlobalTranz Edition WordPress plugin. The issue is an SQL Injection via the engtz_wd_save_dropship AJAX endpoint present in all versions up to 2.3.11, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the SQ...

CVE-2025-1483 LTL Freight Quotes – GlobalTranz Edition <= 2.3.12 - Missing Authorization to Unauthenticated Settings Update

The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engtzwdsavedropship AJAX endpoint in all versions up to, and including, 2.3.12. This makes it possible for unauthenticated attackers to...

WordPress Yoast SEO Plugin < 3.2.5 Information Disclosure Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:yoast:yoastseo"; if description...

CVE-2024-13726

The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-0935

The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2025-1381

A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. This affects an unknown part of the file /ajaxcity.php. The manipulation of the argument CityName leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2024-13726

The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-13726

The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-0935

CVE-2025-0935 concerns the WordPress plugin Media Library Folders (versions up to and including 8.3.0). The issue is a missing capability check on several AJAX actions, allowing authenticated attackers with Author-level access or higher to change plugin settings (e.g., IP-blocking). Impact is una...

PT-2025-6816 · WordPress · Media Library Folders

Name of the Vulnerable Software and Affected Versions: Media Library Folders plugin for WordPress versions up to, and including, 8.3.0 Description: The issue is related to a missing capability check on several AJAX actions, allowing authenticated attackers with Author-level access and above to...

CVE-2024-13769

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...