Ajax Load More < 7.1.0 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read

Description The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.0.1 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents...

PT-2024-23054 · WordPress · Admin-Ajax.Php

Name of the Vulnerable Software and Affected Versions: admin-ajax.php affected versions not specified Description: The issue concerns a reflected Cross Site Scripting vulnerability in the "image url" parameter of the AJAX call to the "editimage bwg" action of admin-ajax.php. This allows an attack...

House Rental Management System SQL注入漏洞

House Rental Management System is a house rental management system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Campcodes House Rental Management System version 1.0, which originates from a SQL injection vulnerability in the parameter username in the file ajax.php...

PT-2024-23053 · WordPress · Admin-Ajax.Php

Name of the Vulnerable Software and Affected Versions: admin-ajax.php affected versions not specified Description: The issue concerns a reflected Cross Site Scripting vulnerability in the image id parameter of the AJAX call to the editimage bwg action of admin-ajax.php. This allows an attacker to...

PT-2024-23056 · WordPress · Admin-Ajax.Php

Name of the Vulnerable Software and Affected Versions: admin-ajax.php affected versions not specified Description: The issue concerns a reflected Cross Site Scripting vulnerability in the thumb url parameter of the AJAX call to the editimage bwg action of admin-ajax.php. This allows an attacker t...

Simple Ajax Chat < 20240216 - Authenticated (Admin+) Stored Cross-Site Scripting

Description The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20231101 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Ajax Load More Plugin <= 7.0.1 is vulnerable to Directory Traversal

Software Ajax Load More Type Plugin Vulnerable versions = 7.0.1 Fixed in 7.1.0 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-1790 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 0e28f3a7fca4 Credits Hoa Le Ngoc lengochoa Required privilege...

CIGESv2 SQL注入漏洞

CIGESv2 is a queue and reservation management system from CIGESv2. CIGESv2 suffers from an SQL injection vulnerability that stems from an SQL injection vulnerability in the parameter idServicio in /ajaxSubServicios.php...

CVE-2022-47604 WordPress AJAX Thumbnail Rebuild plugin <= 1.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13...

CVE-2022-47604

CVE-2022-47604 concerns the WordPress plugin AJAX Thumbnail Rebuild (

CVE-2022-47604 WordPress AJAX Thumbnail Rebuild plugin <= 1.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13...

360 Javascript Viewer < 1.7.13 - Missing Authorization to Plugin Settings Update

Description The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with...

AI Post Generator < 3.4 - Subscriber+ Posts Read/Creation/Deletion

Description The plugin is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions. This makes it possible for authenticated attackers, with subscriber access or higher, to view all posts generated with this plugin...

Inline Related Posts < 3.6.0 - Subscriber+ Password Protected Post Read

Description The plugin does not ensure that post content displayed via an AJAX action are accessible to the user, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts PoC When logged in as a subscriber, open the following URL and note that the...

WordPress Simple Ajax Chat Plugin < 20240223 is vulnerable to Cross Site Scripting (XSS)

Software Simple Ajax Chat Type Plugin Vulnerable versions 20240223 Fixed in 20240223 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1983 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 67c9eb2499f7 Credits fourcade...

PT-2024-11758 · Unknown · Ajax Thumbnail Rebuild

Name of the Vulnerable Software and Affected Versions: AJAX Thumbnail Rebuild versions 1.13 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects the AJAX Thumbnail Rebuild software. Recommendations: For versions 1.13 and earlier, updat...

CVE-2024-1325

The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.3. This is due to missing or incorrect nonce validation on the 'ajaxcancelreview' function. This makes it possible for unauthenticated...

CVE-2024-1983

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users...

CVE-2024-1983 Simple Ajax Chat < 20240223 - Unauthenticated Stored XSS

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users...

CVE-2024-1983

CVE-2024-1983 affects the WordPress plugin Simple Ajax Chat (formerly Simple Ajax Chat – Add a Fast, Secure Chat Box). The Red Hat/NVD description (and related sources) state the issue is that the plugin does not prevent visitors from using malicious Names in chat, which are reflected unsanitized...