WordPress File Manager Advanced Shortcode Plugin <= 2.5.3 is vulnerable to Arbitrary File Upload

Software File Manager Advanced Shortcode Type Plugin Vulnerable versions = 2.5.3 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-7061 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID a8417c3a09b4 Credits Colin Xu Required...

WordPress plugin Generate PDF using Contact Form security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

WordPress Default Thumbnail Plus Plugin <= 1.0.2.3 is vulnerable to Arbitrary File Upload

Software Default Thumbnail Plus Type Plugin Vulnerable versions = 1.0.2.3 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6161 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID ab5c2abdfe96 Credits István Márton Required...

PT-2024-37531 · WordPress · Advanced Ajax Page Loader

Name of the Vulnerable Software and Affected Versions: Advanced AJAX Page Loader plugin for WordPress versions up to, and including, 2.7.7 Description: The issue is due to missing nonce validation in the admin init AAPL function and missing file type validation in the AAPL options validate...

WordPress plugin ScrollToTop security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability...

SAP Enable Now Code Issue Vulnerability

SAP Enable Now is a suite of collaborative content creation, management and sharing platforms from SAP, a German company. The platform is primarily used for online learning and training in SAP and non-SAP systems, among others. SAP Enable Now suffers from a code issue vulnerability that stems fro...

PT-2024-37399 · WordPress · Bit Form

Name of the Vulnerable Software and Affected Versions: Bit Form plugin for WordPress versions up to, and including, 2.13.3 Description: The issue is related to missing file type validation in the iconUpload function, allowing authenticated attackers with administrator-level and above permissions ...

WordPress plugin ScrollTo Bottom security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress WordPress Form Builder Plugin – Gutenberg Forms Plugin <= 2.2.9 is vulnerable to Arbitrary File Upload

Software WordPress Form Builder Plugin – Gutenberg Forms Type Plugin Vulnerable versions = 2.2.9 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6313 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 6945098cfe6d Credits István Márt...

WordPress IQ Testimonials Plugin <= 2.2.7 is vulnerable to Arbitrary File Upload

Software IQ Testimonials Type Plugin Vulnerable versions = 2.2.7 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6314 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 8b1a4c014222 Credits István Márton Required privilege...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.12.3 is vulnerable to Arbitrary File Upload

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.12.3 Fixed in 2.13.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6123 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 569eb657724e Credits István Márton Required...

WordPress Modern Events Calendar Lite plugin <= 7.11.0 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Modern Events Calendar Lite versions = 7.11.0...

WordPress Modern Events Calendar plugin <= 7.11.0 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Modern Events Calendar versions = 7.11.0...

WordPress Modern Events Calendar Plugin <= 7.11.0 is vulnerable to Arbitrary File Upload

Software Modern Events Calendar Type Plugin Vulnerable versions = 7.11.0 Fixed in 7.12.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-5441 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID ef52f2e3acfd Credits Foxyyy Required privilege...

WordPress Modern Events Calendar Lite Plugin <= 7.11.0 is vulnerable to Arbitrary File Upload

Software Modern Events Calendar Lite Type Plugin Vulnerable versions = 7.11.0 Fixed in 7.12.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-5441 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 9f8e6c792dc5 Credits Foxyyy Required privilege...

WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Peng Zhou in WordPress Plugin Church Admin versions = 4.4.6...

CVE-2024-6319

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitra...

CVE-2024-6318

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadimgfile' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload...

CVE-2024-6319

CVE-2024-6319 (IMGspider WordPress plugin) is an authenticated arbitrary file upload vulnerability. The issue arises in the plugin’s upload function where file type validation is missing, enabling attackers with contributor-level or higher permissions to upload arbitrary files to the server. This...

EUVD-2024-47435

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitra...