Element Pack Elementor Addons < 5.5.4 - Authenticated (Contributor+) SQL Injection

Description The Element Pack Elementor Addons plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2024-18565 · WordPress · The Modal Popup Box – Popup Builder

Name of the Vulnerable Software and Affected Versions: The Modal Popup Box – Popup Builder, Show Offers And News in Popup plugin for WordPress versions up to, and including, 1.5.2 Description: The issue allows authenticated attackers with contributor-level access and above to inject a PHP Object...

PT-2024-21092 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions prior to 11.3 Description: The issue concerns a path traversal that could allow a remote, authenticated attacker to access files or execute code outside the intended directory. Recommendations: For Esri Portal...

PT-2024-22521 · WordPress · The Shoplentor

Name of the Vulnerable Software and Affected Versions: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution plugin for WordPress versions up to, and including, 2.8.3 Description: The issue is related to Stored Cross-Site Scripting via the slitems...

CVE-2024-20352

A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient protections for the web UI of an affecte...

CVE-2024-1180

TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605. Authentication is required to exploit this vulnerability. The specific issue...

CVE-2024-1180 TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability

TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605. Authentication is required to exploit this vulnerability. The specific issue...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings vulnerability

AuthenticatedEditor+ Stored Cross-Site Scripting via Contact Form Message Settings vulnerability discovered by Akbar Kustirama in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.17...

WordPress Template Kit – Import plugin <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload vulnerability

AuthenticatedAuthor+ Stored Cross-Site Scripting via template upload vulnerability discovered by Colin Xu in WordPress Plugin Template Kit – Import versions = 1.0.14...

PT-2024-22932 · Lepton · Lepton

Name of the Vulnerable Software and Affected Versions: lepton version 7.1.0 Description: The issue allows remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file. This is a result of a File Upload vulnerability. Recommendations: For lepton version 7.1.0, consider...

WordPress PowerPack Addons for Elementor plugin <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag* vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via htmltag vulnerability discovered by wesley wcraft in WordPress Plugin PowerPack Addons for Elementor versions = 2.7.17...

WordPress Favorites plugin <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Favorites versions = 2.3.3...

CVE-2024-3018

The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'errorresetpassword' attribute of the "Login | Register Form" widget disabled by default. This makes it possib...

PT-2024-18873 · WordPress · Ultimate Addons For Beaver Builder – Lite

Name of the Vulnerable Software and Affected Versions: The Ultimate Addons for Beaver Builder – Lite plugin for WordPress versions up to, and including, 1.5.7 Description: The issue is related to Stored Cross-Site Scripting via the Heading widget due to insufficient input sanitization and output...

WordPress 130+ Widgets | Best Addons For Elementor – FREE plugin <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Xpro Elementor Addons versions = 1.4.2...

WordPress Ajax Load More plugin <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by afei in WordPress Plugin Ajax Load More versions = 7.0.1...

WordPress Pods plugin <= 3.0.10 - Authenticated (Contributor+) SQL Injection via Shortcode vulnerability

Authenticated Contributor+ SQL Injection via Shortcode vulnerability discovered by Nex Team in WordPress Plugin Pods versions = 3.0.10...

CVE-2024-0608 WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union-based SQL Injection via the 'email' parameter in all versions up to, and including, 1.13.1 due to insufficient escaping on the user supplied parameter and...

CVE-2024-2936

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute of widgets in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-2841

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping on user supplied attribute...