9936 matches found
CVE-2024-10853
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-8874 AJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scripting
The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to...
CVE-2024-8874 AJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scripting
The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to...
CVE-2024-8874
The CVE-2024-8874 entry describes a Reflected XSS in the WordPress plugin “AJAX Login and Registration modal popup + inline form” for versions up to 2.24, due to insufficient escaping when using add_query_arg. The vulnerability affects unauthenticated users who can lure a user into an action (e.g...
CVE-2024-10854 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...
CVE-2024-10854
CVE-2024-10854 concerns the WordPress plugin Buy one click WooCommerce (<= 2.2.9). The root cause is a missing capability check on the AJAX action buy_one_click_import_options , allowing authenticated users with Subscriber-level access and above to modify/import plugin settings. The vulnerabil...
WordPress plugin User Extra Fields 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...
WordPress AJAX Random Posts Plugin <= 0.3.3 is vulnerable to PHP Object Injection
Software AJAX Random Posts Type Plugin Vulnerable versions = 0.3.3 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52409 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 88448bab09ca Credits Bonds Required privilege Unauthenticated...
PT-2024-16591 · WordPress · Buy One Click Woocommerce Plugin
Name of the Vulnerable Software and Affected Versions: Buy one click WooCommerce plugin for WordPress versions up to, and including, 2.2.9 Description: The issue arises from a missing capability check on the buy one click export options AJAX action, allowing authenticated attackers with...
WordPress AJAX Login and Registration modal popup + inline form Plugin <= 2.24 is vulnerable to Cross Site Scripting (XSS)
Software AJAX Login and Registration modal popup + inline form Type Plugin Vulnerable versions = 2.24 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8874 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...
Exploit for Code Injection in Wppa Wp_Photo_Album_Plus
WordPress WP Photo Album Plus Arbitrary Shortcode Execution...
CVE-2024-10958
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action that does not properly validate a value...
CVE-2024-10958 WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action that does not properly validate a value...
CVE-2024-10958
CVE-2024-10958 affects the WP Photo Album Plus WordPress plugin. The Red Hat and Wordfence sources confirm an unauthenticated arbitrary shortcode execution vulnerability via the getshortcodedrenderedfenodelay AJAX action in versions up to 8.8.08.007. The underlying issue is a lack of proper valid...
PT-2024-16662 · WordPress · Wp Photo Album Plus
Name of the Vulnerable Software and Affected Versions: WP Photo Album Plus versions prior to 8.8.08.007 WP Photo Album Plus versions prior to 8.8.08.004 Description: The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via the getshortcodedrenderedfenodelay...
CVE-2024-51717
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Perception System System Pvt. Ltd. Ajax Content Filter ajax-content-filter allows Reflected XSS.This issue affects Ajax Content Filter: from n/a through = 1.0...
CVE-2024-51717
CVE-2024-51717 – Reflected XSS in Ajax Content Filter (WordPress). Affected: Ajax Content Filter plugin, versions up to 1.0. Root cause: improper neutralization of input during web page generation. Consequences: reflected cross-site scripting as described by the CVE. Exploit status, affected prod...
CVE-2024-51717 WordPress Ajax Content Filter plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Perception System System Pvt. Ltd. Ajax Content Filter ajax-content-filter allows Reflected XSS.This issue affects Ajax Content Filter: from n/a through = 1.0...
CVE-2024-51717 WordPress Ajax Content Filter plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Perception System System Pvt. Ltd. Ajax Content Filter ajax-content-filter allows Reflected XSS.This issue affects Ajax Content Filter: from n/a through = 1.0...
CVE-2024-10871
The Category Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.2 via the 'paramscaf-post-layout' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...