CVE-2023-6947

The CVE-2023-6947 entry concerns the WordPress FooGallery plugin. Vulnerable component: FooGallery plugin for WordPress (versions up to and including 2.4.26). Root cause: Directory traversal flaw that allows an authenticated attacker with contributor level or higher to read arbitrary server folde...

CVE-2023-6947 Best WordPress Gallery Plugin – FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, whic...

CVE-2024-11205

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-11205

The CVE-2024-11205 entry applies to the WPForms WordPress plugin. A missing capability check in wpforms_is_admin_page affects versions 1.8.4 through 1.9.2.1, enabling authenticated users with Subscriber-level access and above to refund payments and cancel subscriptions. The issue is mitigated by ...

PT-2024-15135 · WordPress · Foogallery

Name of the Vulnerable Software and Affected Versions: FooGallery plugin for WordPress versions up to, and including, 2.4.26 Description: The FooGallery plugin for WordPress has a Directory Traversal issue. This allows authenticated attackers with contributor level or higher to read the contents ...

CVE-2024-11501

CVE-2024-11501 concerns the WordPress Gallery plugin (versions

CVE-2024-11380 Mini Program API <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Mini Program API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'qvideo' shortcode in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11501 Gallery <= 1.3 - Authenticated (Contributor+) PHP Object Injection

The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrusted input from wdgallery$id parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object...

CVE-2024-11380

CVE-2024-11380 : The Mini Program API plugin for WordPress (versions ≤ 1.4.5) is affected by a stored XSS in the qvideo shortcode due to insufficient input sanitization/output escaping of user attributes. This allows authenticated attackers with contributor-level access or higher to inject script...

CVE-2024-11010

The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.1.4 via the 'defaultlang' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, ...

CVE-2024-11010

CVE-2024-11010 affects FileOrganizer – Manage WordPress and Website Files (WordPress) up to version 1.1.4. It allows Local JavaScript File Inclusion via the default_lang parameter. Exploitation requires Administrator-level access, and can cause arbitrary JavaScript execution on the server, potent...

CVE-2024-12253

CVE-2024-12253 concerns the WordPress plugin “Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal” (versions up to 3.1.2). The issue is a missing capability check on actions including ‘save_settings’, ‘export_csv’, and ‘simpleecommcart-action’, which allows an attacker with subscr...

CVE-2024-8679

The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter of the owtlibhandler AJAX action in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2024-11451

The Zooom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zooom' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...

CVE-2024-11904

The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'msnttaddplustalk' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-8679 Library Management System <= 3.1 - Authenticated (Admin+) SQL Injection

The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter of the owtlibhandler AJAX action in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2024-11353

CVE-2024-11353 affects the WordPress plugin SMS for Lead Capture Forms (ClickSend Lead Capture Form). The vulnerability is a missing capability check in the delete_message() function across all versions up to 1.1.0, allowing authenticated attackers with Subscriber+ privileges to perform unauthori...

CVE-2024-11904 코드엠샵 소셜톡 <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'msnttaddplustalk' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11904

CVE-2024-11904 : The WordPress plugin 코드엠샵 소셜톡 (mshop-naver-talktalk) ≤ 1.2.0 suffers a Stored Cross-Site Scripting vulnerability via the shortcode msntt_add_plus_talk due to insufficient input sanitization and output escaping. Authenticated attackers with at least contributor access can inject s...

CVE-2024-12026

CVE-2024-12026 is a vulnerability in the WordPress plugin Message Filter for Contact Form 7 (versions up to 1.6.3) where a missing capability check in the saveFilter() function allows authenticated users with Subscriber-level access and above to create new filters, enabling unauthorized modificat...