CVE-2024-9821

CVE-2024-9821 : The WordPress plugin “Bot for Telegram on WooCommerce” is vulnerable to sensitive information disclosure due to missing authorization checks on the stm_wpcfto_get_settings AJAX action, affecting all versions up to 1.2.4. Authenticated attackers with subscriber-level access and abo...

CVE-2024-9821 Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stmwpcftogetsettings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with...

PT-2024-39866 · WordPress · The Bot For Telegram On Woocommerce

Name of the Vulnerable Software and Affected Versions: The Bot for Telegram on WooCommerce plugin for WordPress versions up to, and including, 1.2.4 Description: The issue is related to sensitive information disclosure due to missing authorization checks on the 'stm wpcfto get settings' AJAX...

WordPress plugin Order Attachments for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Exploit for CVE-2024-9821

CVE-2024-9821 Bot for Telegram on WooCommerce = 1.2.4 - Au...

CVE-2024-9587

The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajaxlinkz' function in versions up to, and including, 1.1.8. This makes it possible for authenticated attackers with contributor-level privileges or above, to update plug...

WordPress plugin Linkz.ai 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-8513

The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsavepluginconfig function in all versions up to, and including, 4.1.0.0. This makes it possibl...

CVE-2024-9522 WP Users Masquerade <= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass

The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.0. This is due to incorrect authentication and capability checking in the 'ajaxmasqlogin' function. This makes it possible for authenticated attackers, with subscriber-level...

PT-2024-39704 · WordPress · Linkz.Ai

Name of the Vulnerable Software and Affected Versions: Linkz.ai plugin for WordPress versions up to, and including, 1.1.8 Description: The issue allows unauthorized modification of data due to a missing capability check on the ajax linkz function. This makes it possible for authenticated attacker...

Exploit for CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - Missing Authorization via...

PT-2024-39065 · WordPress · Qa Analytics – Web Analytics Tool With Heatmaps & Session Replay Across All Pages

Name of the Vulnerable Software and Affected Versions: QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress versions up to, and including, 4.1.0.0 Description: The issue is related to a missing capability check on the ajax save plugin config...

CVE-2024-8431

CVE-2024-8431 affects the WordPress plugin Robo Gallery (Photo Gallery, Images, Slider) up to version 3.2.21. The flaw is a missing capability check in ajaxGetGalleryJson(), allowing authenticated users with Subscriber+ privileges to retrieve private post titles. Public exploitation details are n...

CVE-2024-47350

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-ajax-search.This issue affects YITH WooCommerce Ajax Search: from n/a through = 2.8.0...

CVE-2024-47350 WordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-ajax-search.This issue affects YITH WooCommerce Ajax Search: from n/a through = 2.8.0...

CVE-2024-47350

CVE-2024-47350 is a SQL injection vulnerability in the YITH WooCommerce Ajax Search plugin (versions

WordPress plugin YITH WooCommerce Ajax Search SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

CVE-2024-8505

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttonlabel’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-8505

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttonlabel’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-8505 WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttonlabel’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...