11428 matches found
WordPress CRM Perks plugin <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin CRM Perks versions = 1.1.6...
Dell Avamar Fitness Analyzer API SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Dell Avamar. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of the proxies parameter provided to the timeline endpoint. The issue...
PT-2024-36520 · Ujcms · Ujcms
Name of the Vulnerable Software and Affected Versions: UJCMS version 9.6.3 Description: A URL redirection vulnerability exists in UJCMS due to improper validation of URLs in the upload and rendering of new block/carousel items. This issue allows authenticated attackers to redirect unprivileged...
Exploit for CVE-2024-53376
CVE-2024-53376 CyberPanel Authenticated OS Command Injection...
CVE-2024-11714 WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'ff' parameter of the getFieldsForVisibleCombobox function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied...
CVE-2024-11713 WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'pageid' parameter of the wpjobportaldeactivate function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied...
CVE-2024-12446 Post to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptpsinglepost' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-12459 Ganohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Ganohrs Toggle Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'toggle' shortcode in all versions up to, and including, 0.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-11752 Eveeno <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Eveeno plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eveeno' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...
CVE-2024-12474
CVE-2024-12474 – WordPress GeoDataSource Country Region DropDown : The WordPress plugin is vulnerable to Stored Cross-Site Scripting via the gds-country-dropdown shortcode in all versions up to and including 1.0.1 due to insufficient input sanitization and output escaping. Exploitation requires a...
CVE-2024-12501 Simple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...
CVE-2024-11869
CVE-2024-11869 – Buk for WordPress (WordPress plugin) : Stored XSS via the plugin’s buk shortcode in all versions up to 1.0.7, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access (contributor level or higher); scrip...
CVE-2024-11869 Buk for WordPress <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Buk for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buk' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2024-11888
CVE-2024-11888 (IDer Login for WordPress) stores cross-site scripting in the IDer Login for WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping on attributes of the ider_login_button shortcode, enabling stored XSS when an authenticated user with con...
CVE-2024-11855 Koalendar – Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter
The Koalendar – Events & Appointments Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2024-12458 Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-12448
CVE-2024-12448 affects Posts and Products Views for WooCommerce (WordPress plugin). Root cause: insufficient input sanitization and output escaping on user-supplied attributes in the plugin shortcode papvfwc_views, enabling stored Cross-Site Scripting. Impact: authenticated attackers with contrib...
CVE-2024-11770 Post Carousel & Slider <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-11755 IMS Countdown <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The IMS Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown post settings in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...