CVE-2024-7084

The Ajax Search Lite WordPress plugin (versions prior to 4.12.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to properly sanitise and escape certain parameters. This flaw allows users with a role as low as Admin+ to execute XSS attacks. To mitigate...

CVE-2024-7084 Ajax Search Lite < 4.12.1 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks...

CVE-2024-7485 Traffic Manager <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting

The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX function in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-7485 Traffic Manager <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting

The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX function in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress plugin Ajax Search Lite has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-7084: Improper Neutralization of Input During Web Page Generation

The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks...

PT-2024-38069 · WordPress · Ajax Search Lite

Name of the Vulnerable Software and Affected Versions: Ajax Search Lite WordPress plugin versions prior to 4.12.1 Description: The issue allows users with a role as low as Admin+ to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters...

WordPress Ajax Search Lite Plugin < 4.12.1 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Search Lite Type Plugin Vulnerable versions 4.12.1 Fixed in 4.12.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7084 Patch priority Low CVSS severity Low 5.9 Developer WPdreams PSID 325c5ede1534 Credits Krugov Artyom Required privile...

WordPress plugin Superfly Responsive Menu has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-7368

CVE-2024-7368 affects SourceCodester Simple Realtime Quiz System 1.0 in the /ajax.php?action=save_quiz endpoint. The vulnerability arises from manipulating the title parameter, enabling cross-site scripting (XSS). The issue can be exploited remotely and is publicly disclosed. Exploit details are ...

CVE-2024-7367 SourceCodester Simple Realtime Quiz System ajax.php cross-site request forgery

A vulnerability, which was classified as problematic, was found in SourceCodester Simple Realtime Quiz System 1.0. This affects an unknown part of the file /ajax.php?action=saveuser. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit...

CVE-2024-7360

A vulnerability classified as problematic has been found in SourceCodester Tracking Monitoring Management System 1.0. This affects an unknown part of the file /ajax.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been...

CVE-2024-1747

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack o...

CVE-2024-1747 WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack o...

CVE-2024-1747

The WooCommerce Customers Manager WordPress plugin (versions prior to 30.2 ) is vulnerable to a lack of authorization and CSRF protection in various AJAX actions. This flaw allows any authenticated user, such as a subscriber, to create, update, or delete customer metadata. Because the plugin fail...

CVE-2024-1747 WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack o...

PT-2024-38291 · Sourcecodester · Sourcecodester Tracking Monitoring Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Tracking Monitoring Management System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file /ajax.php. This issue leads to cross-site request forgery and can be initiat...

SourceCodester Tracking Monitoring Management System Cross-site Request Forgery Vulnerability

SourceCodester Tracking Monitoring Management System is a monitoring management system from SourceCodester, Inc. A cross-site request forgery vulnerability exists in the SourceCodester Tracking Monitoring Management System version 1.0, which is caused by the /ajax.php file containing a cross-site...

CVE-2024-1747: Cross-Site Request Forgery (CSRF)

The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack o...

PT-2024-18272 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 30.2 Description: The issue concerns a lack of authorization and CSRF protection in various AJAX actions within the plugin, allowing any authenticated user to update, delete, or...