PT-2024-18325 · WordPress · Analytify – Google Analytics Dashboard For Wordpress

Name of the Vulnerable Software and Affected Versions: The Analytify – Google Analytics Dashboard For WordPress plugin for WordPress versions up to, and including, 5.2.3 Description: The issue allows authenticated attackers with subscriber access or higher to obtain certain sensitive information...

PT-2024-28819 · WordPress · Sydney Toolbox

Name of the Vulnerable Software and Affected Versions: The Sydney Toolbox plugin for WordPress versions up to, and including, 1.30 Description: The issue is related to Stored Cross-Site Scripting via the style parameter due to insufficient input sanitization and output escaping. This allows...

PT-2024-27579 · WordPress · Blocksy

Name of the Vulnerable Software and Affected Versions: Blocksy theme for WordPress versions up to, and including, 2.0.39 Description: The issue is related to Stored Cross-Site Scripting via the className parameter in the About Me block due to insufficient input sanitization and output escaping...

PT-2024-17218 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress versions up to, and including, 1.13.1 Description: The issue is related to time-based SQL Injection via the id parameter due to...

WordPress Sydney Toolbox plugin <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin Sydney Toolbox versions = 1.30...

WP Video Lightbox < 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

Description The WP Video Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-1895

The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.4 via deserialization via shortcode of untrusted input from a custom meta value. This makes it possible for authenticated...

WordPress Photo Gallery plugin <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode vulnerability

AuthenticatedContributor+ PHP Object Injection via Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Photo Gallery – Responsive Photo Gallery versions = 1.4.2...

WordPress Fancy Elementor Flipbox plugin <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget vulnerability discovered by Francesco Carlucci in WordPress Plugin Fancy Elementor Flipbox versions = 2.5.1...

WordPress Google Doc Embedder plugin <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery vulnerability

Authenticated Contributor+ Blind Server Side Request Forgery vulnerability discovered by István Márton in WordPress Plugin Google Document Embedder versions = 2.6.4...

WordPress MailerLite – Signup forms (official) plugin <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Richard Telleng stueotue in WordPress Plugin MailerLite versions = 1.7.6...

PT-2024-21304

Name of the Vulnerable Software and Affected Versions RTU500 affected versions not specified Description A vulnerability exists in the RTU500 that allows authenticated and authorized users to bypass secure update. If a malicious actor successfully exploits this vulnerability, they could use it to...

PT-2024-23586 · WordPress · Acf On-The-Go

Name of the Vulnerable Software and Affected Versions: ACF On-The-Go plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to a missing capability check on the acfg update fields function, allowing authenticated attackers with subscriber-level access and abov...

WordPress All in One SEO plugin <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin All In One SEO Pack versions = 4.6.0...

WordPress Qi Addons For Elementor plugin <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Countdown widget vulnerability discovered by Webbernaut in WordPress Plugin Qi Addons For Elementor versions = 1.7.0...

CVE-2023-50364

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS...

Form Maker by 10Web < 1.15.25 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting

Description The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name autofilled into forms in all versions up to, and including, 1.15.24 due to insufficient input sanitization and output...

WordPress XforWooCommerce plugin <= 2.0.2 - Authenticated Local File Inclusion vulnerability

Authenticated Local File Inclusion vulnerability discovered by Dave Jong Patchstack in WordPress Plugin XforWooCommerce versions = 2.0.2...

PT-2024-3535 · Qnap · Qts +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.6.2722 build 20240402 QuTS hero versions prior to h5.1.6.2734 build 20240414 Description: The issue is caused by a buffer copy without checking the size of input, which may allow authenticated users to execute code v...

CVE-2023-20248

A vulnerability in the web-based management interface of Cisco TelePresence Management Suite TMS Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient input validation by the...