WordPress Element Pack Pro plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL vulnerability

AuthenticatedContributor+ Stored Cross-Site Scripting via Wrapper Link URL vulnerability discovered by Francesco Carlucci in WordPress Plugin Element Pack Pro versions = 7.9.0...

WordPress Formidable Forms plugin <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Formidable Forms versions = 6.11.1...

CVE-2024-41916 Authenticated Sensitive Information Disclosure in ClearPass Policy Manager

A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network...

Xibo CMS SQL注入漏洞

Xibo CMS is an open source content management system from Xibo Digital Signage. Xibo CMS suffers from a SQL injection vulnerability that originates from allowing authenticated users to obtain and modify arbitrary data from the database by injecting specially crafted values into the API...

WordPress Master Currency WP plugin <= 1.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via Currency Converter Form Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Currency Converter Form Shortcode vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin Master Currency WP versions = 1.1.61...

M-Files Hubshare 安全漏洞

M-Files Hubshare is a collaboration solution from M-Files, Inc. designed to seamlessly share files, documents and collaborative content. A security vulnerability exists in M-Files Hubshare version 5.0.6.0 that stems from vulnerability to a stored cross-site scripting attack that allows an...

PT-2024-37417 · WordPress · Flipbox Builder

Name of the Vulnerable Software and Affected Versions: Flipbox Builder plugin for WordPress versions up to, and including, 1.5 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input in the flipbox...

PT-2024-37741 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.8.2 Description: The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server via the render conte...

Webuzo 安全漏洞

Webuzo is a powerful and easy-to-use web hosting control panel from Webuzo Inc. Allows hosting providers and users to automate server administration tasks while providing customers with the tools they need to manage their sites. A security vulnerability exists in Webuzo that stems from the...

CVE-2024-5818

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widget in all versions up to, and including, 1.3.980 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2024-6752

The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpname’ parameter in the 'wpwautopostermapwordpressposttype' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it...

WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by wesley wcraft in WordPress Plugin AMP for WP versions = 1.0.96.1...

PT-2024-37895 · Funnelkit · The Funnel Builder For Wordpress

Name of the Vulnerable Software and Affected Versions: The Funnel Builder for WordPress by FunnelKit versions up to, and including, 3.4.6 Description: The issue allows authenticated attackers with Contributor-level access and above to update multiple settings due to a missing capability check on...

Hewlett Packard Enterprise EdgeConnect SD-WAN 安全漏洞

Hewlett Packard Enterprise EdgeConnect SD-WAN is Hewlett Packard Enterprise's secure network foundation for Zero Trust and SASE. It includes best-in-class SD-WAN and next-generation firewalls that deliver unrivaled quality of experience and advanced security. A security vulnerability exists in...

PT-2024-28878

Name of the Vulnerable Software and Affected Versions Linksys Router E2500 version 2.0.00 Description A vulnerability was discovered that allows authenticated attackers to execute arbitrary code via the hnd parentalctrl unblock function. Recommendations For Linksys Router E2500 version 2.0.00,...

CVE-2024-6420 Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page...

WordPress MaxiBlocks plugin <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Lucio Sá in WordPress Plugin MaxiBlocks versions = 1.9.2...

WordPress Mercado Pago payments for WooCommerce plugin 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download vulnerability

WordPress Mercado Pago payments for WooCommerce plugin 7.3.0 - 7.6.1 - Authenticated Subscriber+ Arbitrary File Download vulnerability discovered by Krzysztof Zając in WordPress Plugin Mercado Pago payments for WooCommerce versions 7.3.0 - 7.6.1...

CVE-2024-5977

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-5977 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated...