CVE-2024-0235 EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog...

CVE-2024-0235 EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog...

CVE-2023-6824 WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2024-0236

CVE-2024-0236 affects the WordPress EventON plugin, with unauthenticated access in an AJAX action that allows retrieval of arbitrary virtual-event settings, including meeting passwords (e.g., Zoom). Technical details across connected documents show vulnerable versions: EventON prior to 4.5.5 and ...

CVE-2024-0236 EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password Disclosure

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events, including any meeting password set for example for Zoom...

CVE-2023-6824 WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

CVE-2023-6741 WP Customer Area < 8.2.1 - Subscriber+ Account Address Update

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address...

CVE-2024-0237

The CVE-2024-0237 issue affects the EventON WordPress plugin, with unauthenticated updates to virtual event settings via certain AJAX actions. Concrete details across sources indicate: Affected software: EventON WordPress plugin versions prior to 4.5.9 (and, per other entries, 4.5.8) and EventON ...

CVE-2023-3178

CVE-2023-3178 affects the WordPress plugin Post SMTP Mailer prior to version 2.5.7. The vulnerability is due to improper CSRF checks in certain AJAX actions, which could allow an attacker to leverage a logged-in user with the manage_postman_smtp capability to delete arbitrary logs via CSRF. Affec...

CVE-2023-3211 WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection

The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-3211 WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection

The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2021-24870

CVE-2021-24870 concerns the WordPress plugin WP Fastest Cache prior to 0.9.5. The vulnerability is a CSRF/checks-and-escaping flaw in the wpfc_save_cdn_integration AJAX action, coupled with insufficient sanitization/escaping of options, which could allow a logged-in, high-privilege user to trigge...

CVE-2021-24432

The CVE-2021-24432 entry relates to the WordPress plugin Advanced AJAX Product Filters. The connected documents confirm a vulnerability in the br_aapf_get_child AJAX action where the POST parameter term_id is not sanitized before being output, causing unauthenticated reflected XSS. Affected versi...

PT-2024-11503 · WordPress · The Super Forms - Drag & Drop Form Builder

Name of the Vulnerable Software and Affected Versions: The Super Forms - Drag & Drop Form Builder WordPress plugin versions prior to 6.0.4 Description: The issue is related to a Reflected Cross-Site Scripting problem. The bob czy panstwa sprawa zostala rozwiazana parameter is not properly escaped...

WordPress plugin WordPress Database Administrator security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin Royal Elementor Addons and Templates security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

PT-2024-15403 · WordPress · Eventon

Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 4.5.9 EventON WordPress plugin versions prior to 2.2.7 Description: The issue concerns a lack of authorization in some AJAX actions within the EventON WordPress plugin, allowing unauthenticated users...

WordPress plugin Super Forms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-15100 · Unknown · Wp Customer Area

Name of the Vulnerable Software and Affected Versions: WP Customer Area versions prior to 8.2.1 Description: The issue arises from improper validation of user capabilities in certain AJAX actions, allowing any user to retrieve another user's account address. Recommendations: For versions prior to...

PT-2024-10894 · WordPress · Wp Fastest Cache

Name of the Vulnerable Software and Affected Versions: WP Fastest Cache versions prior to 0.9.5 Description: The issue is related to a lack of CSRF check in the wpfc save cdn integration AJAX action and insufficient sanitization and escaping of some options available via this action. This could...