PT-2024-4343

Name of the Vulnerable Software and Affected Versions Pandora FMS versions 700 through 776 Description The issue is related to OS Command injection in Ajax PHP files via HTTP Request, allowing the execution of system commands by exploiting variables. This can enable an attacker to execute arbitra...

CVE-2024-5613

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'qualitycustomizernotifydismissaction' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-5638

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ticustomizernotifydismissrecommendedplugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-5638

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ticustomizernotifydismissrecommendedplugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-5613

The Formula WordPress theme has CVE-2024-5613: a Reflected XSS via the id parameter in the quality_customizer_notify_dismiss_action AJAX action, affecting all versions up to 0.5.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts into...

CVE-2024-5613 Formula <= 0.5.1 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'qualitycustomizernotifydismissaction' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-5638

CVE-2024-5638 is a Reflected XSS affecting the Formula WordPress theme. The vulnerability arises from insufficient input sanitization and output escaping in the ti_customizer_notify_dismiss_recommended_plugins AJAX action, enabling unauthenticated attackers to inject script via the id parameter i...

CVE-2024-5638 Formula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ticustomizernotifydismissrecommendedplugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-5638 Formula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins

The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ticustomizernotifydismissrecommendedplugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2024-5770

The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajaxsavesetting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permission...

WordPress plugin WP Reset security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-5599

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 via the 'fileorganizerajaxhandler' function. This makes it possible for unauthenticated attackers to extract sensitive data...

PT-2024-36643

Name of the Vulnerable Software and Affected Versions The FileOrganizer – Manage WordPress and Website Files plugin for WordPress versions up to, and including, 1.0.7 Description The issue allows unauthenticated attackers to extract sensitive data, including backups or other sensitive information...

PT-2024-37136 · WordPress · Wp Force Ssl & Https Ssl Redirect

Name of the Vulnerable Software and Affected Versions: WP Force SSL & HTTPS SSL Redirect plugin for WordPress versions up to, and including, 1.66 Description: The issue is related to unauthorized modification of data due to a missing capability check on the ajax save setting function. This allows...

Formula < 0.5.2 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins

Description The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ticustomizernotifydismissrecommendedplugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it...

PT-2024-36809 · WordPress · Formula Theme

Name of the Vulnerable Software and Affected Versions: Formula theme for WordPress versions up to, and including, 0.5.1 Description: The issue is related to Reflected Cross-Site Scripting via the id parameter in the "ti customizer notify dismiss recommended plugins" AJAX action. This is due to...

PT-2024-36720 · WordPress · Formula

Name of the Vulnerable Software and Affected Versions: The Formula theme for WordPress versions up to, and including, 0.5.1 Description: The issue is related to Reflected Cross-Site Scripting via the id parameter in the 'quality customizer notify dismiss action' AJAX action due to insufficient...

Formula < 0.5.2 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action

Description The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'qualitycustomizernotifydismissaction' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possib...

WordPress The Moneytizer plugin <= 9.6.3 - Missing Authorization via multiple AJAX actions vulnerability

Missing Authorization via multiple AJAX actions vulnerability discovered by Francesco Carlucci in WordPress Plugin The Moneytizer versions = 9.6.3...

CVE-2023-6966

The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/coreajax.php file in all versions up to, and including, 9.5.20. This makes it possible for...