CVE-2024-11848

The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropackdismissnoticeforever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-4455

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-57076

A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57076

A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

PT-2025-5753

Name of the Vulnerable Software and Affected Versions: ajax-request version 1.2.3 Description: A prototype pollution in the lib.post function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. This issue can be exploited by providing a manipulated payload to the...

CVE-2024-57076

A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

1filecompiler (0.0.2), @afuh-test/gatsby-theme-minimal (>=0.1.1, <=0.1.7) +339 more potentially affected by CVE-2024-57076 via ajax-request (>=1.2.1, <=1.2.3)

ajax-request NPM version =1.2.1, =0.1.1, =0.1.0, =0.37.8, =1.0.1, =3.0.3, =2.0.8, =2.0.1, =3.0.6, =3.0.4, =3.0.6, =3.0.6, =3.0.6, =7.0.3 - @bodar/totallylazy 0.281.126 and more Source cves: CVE-2024-57076 Source advisory: MEND:CVE-2024-57076...

ajax-request security vulnerability

ajax-request is a nodejs HTTP request by nothing personal developer. A security vulnerability exists in ajax-request v1.2.3, which stems from the lib.post function containing a prototype contamination vulnerability...

CVE-2024-57076

A prototype pollution vulnerability exists in the lib.post function of the ajax-request Node.js HTTP request library, specifically affecting version v1.2.3 . An attacker can exploit this flaw by supplying a crafted payload to cause a Denial of Service (DoS) . A proof-of-concept has been published...

CVE-2024-57076: Uncontrolled Resource Consumption

A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-53719

Cross-Site Request Forgery CSRF vulnerability in onigetoc Zajax – Ajax Navigation zajax-ajax-navigation allows Stored XSS.This issue affects Zajax – Ajax Navigation: from n/a through = 0.4...

CVE-2025-23561 WordPress MLL Audio Player MP3 Ajax plugin <= 0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound MLL Audio Player MP3 Ajax allows Stored XSS. This issue affects MLL Audio Player MP3 Ajax: from n/a through 0.7...

CVE-2025-23561

CVE-2025-23561 is a stored XSS issue in the WordPress plugin scenario: NotFound MLL Audio Player MP3 Ajax (MLL Audio Player MP3 Ajax) affected from n/a to version 0.7. The vulnerability arises from improper input neutralization during web page generation, enabling stored cross-site scripting. Pub...

PT-2025-4941

Name of the Vulnerable Software and Affected Versions MLL Audio Player MP3 Ajax versions 0.7 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

CVE-2025-23561: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in robertkay MLL Audio Player MP3 Ajax music-let-loose-mp3-audio-player allows Stored XSS.This issue affects MLL Audio Player MP3 Ajax: from n/a through = 0.7...

CVE-2024-13775

The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajaxdeletemessage', 'ajaxgetcustomerspartiallist', and 'ajaxgetadminslist' functions in all versions up to, and including, 17.8. This makes it...

CVE-2024-12825

The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2024-12825

The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2024-12825

CVE-2024-12825 : The WordPress plugin Custom Related Posts (all versions up to 1.7.3) suffers a missing capability check on three AJAX actions. This allows authenticated users with Subscriber-level access and above to search posts and link/unlink relations, enabling unauthorized data access/modif...

CVE-2024-12825 Custom Related Posts <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation Updates

The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above...