CVE-2024-11012 Notibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text

The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njtnofitext AJAX action in all versions up to, and including, 2.1.4. This is due to the software allowing users to execute an action that does not properly validate a value...

PT-2024-16700

Name of the Vulnerable Software and Affected Versions Notibar – Notification Bar para WordPress versions up to 2.1.4 Description The issue allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes due to the software permitting users to execute an actio...

WordPress Wp Login with Ajax plugin <= 0.6 - CSRF to Stored Cross-Site Scripting vulnerability

CSRF to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Wp Login with Ajax versions = 0.6...

CVE-2024-12333

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the woodmartinstagramajaxquery AJ...

CVE-2024-11724

The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wplscriptsave AJAX action in all versions up to, and including, 3.6.5...

CVE-2024-10568 Ajax Search Lite < 4.12.4 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10568 Ajax Search Lite < 4.12.4 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10568

The Ajax Search Lite WordPress plugin (versions before 4.12.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly sanitize and escape certain settings. This flaw could allow high-privilege users, such as administrators, to perform XSS attacks, even in environments wh...

PT-2024-16371 · WordPress · Ajax Search Lite

Name of the Vulnerable Software and Affected Versions: Ajax Search Lite WordPress plugin versions prior to 4.12.4 Description: The issue concerns the Ajax Search Lite WordPress plugin, where versions prior to 4.12.4 do not properly sanitize and escape some of its settings. This could allow...

WordPress plugin Ajax Search Lite has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-17548 · WordPress · Woodmart

Name of the Vulnerable Software and Affected Versions: Woodmart theme for WordPress versions up to 8.0.3 Description: The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software permitting users to execute an action without properly validating a value before...

PT-2024-17640 · WordPress · Arena.Im

Name of the Vulnerable Software and Affected Versions: Arena.IM – Live Blogging for real-time events plugin for WordPress versions up to, and including, 0.3.0 Description: The issue is due to missing or incorrect nonce validation on the albfre user action AJAX action. This allows unauthenticated...

CVE-2024-10568: Improper Neutralization of Input During Web Page Generation

The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2024-17288

Name of the Vulnerable Software and Affected Versions RapidLoad – Optimize Web Vitals Automatically plugin for WordPress versions prior to 2.4.3 Description The issue concerns unauthorized access and modification of data due to a missing capability check in several functions, including uucss data...

PT-2024-17398

Name of the Vulnerable Software and Affected Versions WPC Order Notes for WooCommerce plugin for WordPress versions up to, and including, 1.5.2 Description The issue is due to missing or incorrect nonce validation on the ajax update order note function, making it possible for unauthenticated...

CVE-2024-10959

CVE-2024-10959 details (Wordfence/Red Hat source): Affected software is the WordPress plugin Active Products Tables for WooCommerce. Use constructor to create tables . The vulnerability is an unauthenticated arbitrary shortcode execution via the woot_get_smth AJAX action, caused by executing do_s...

PT-2024-16663

Name of the Vulnerable Software and Affected Versions The Active Products Tables for WooCommerce plugin for WordPress versions up to, and including, 1.0.6.5 Description The issue allows arbitrary shortcode execution via the woot get smth AJAX action. This is due to the software allowing users to...

CVE-2023-49859

Missing Authorization vulnerability in Marcus aka @msykes Login With Ajax login-with-ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through = 4.1...

PT-2024-13824

Name of the Vulnerable Software and Affected Versions Pixelite Login With Ajax versions 4.1 and earlier Description The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations For Pixelite Login With...

WordPress plugin for login with Ajax has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...