CVE-2024-1745 Testimonial Slider < 2.3.7 - Author+ Settings Update

The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them...

CVE-2024-1745 Testimonial Slider < 2.3.7 - Author+ Settings Update

The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them...

WordPress Testimonial Slider Plugin < 2.3.7 is vulnerable to Broken Access Control

Software Testimonial Slider Type Plugin Vulnerable versions 2.3.7 Fixed in 2.3.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1745 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID e4275e227f6f Credits Dmitrii Ignatyev Required...

WordPress MyBookTable Bookstore Plugin <= 3.3.7 is vulnerable to Cross Site Scripting (XSS)

Software MyBookTable Bookstore Type Plugin Vulnerable versions = 3.3.7 Fixed in 3.3.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2024-29772 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b4a056c5d251 Credits CatFather Required...

PT-2024-2396 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ version 3.2.5 Description: A SQL injection vulnerability has been discovered in the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to...

SEOPress – On-site SEO < 7.6 - Author+ Stored Cross-Site Scripting

Description The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary we...

Exploit for CVE-2023-22622

DoS WP-Cron - CVE-2023-22622 Exploit PoC Overview This re...

CVE-2024-2538

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajaxsavepermalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above,...

Site Reviews < 6.11.7 - Authenticated (Author+) Stored Cross-Site Scripting

Description The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.11.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject...

Hitachi NAS SMU 14.8.7825 Information Disclosure

Exploit Title: Hitachi NAS HNAS System Management Unit SMU 14.8.7825 - Information Disclosure CVE: CVE-2023-6538 Date: 2023-12-13 Exploit Author: Arslan Masood @arszilla Vendor: https://www.hitachivantara.com/ Version: --id --sso " Create --host argument: parser.addargument "--host", required=Tru...

PT-2024-20908 · WordPress · Permalink Manager Lite

Name of the Vulnerable Software and Affected Versions: Permalink Manager Lite plugin for WordPress versions up to, and including, 2.4.3.1 Description: The issue arises from a missing capability check on the ajax save permalink function, allowing authenticated attackers with author access or above...

Quick.CMS 6.7 SQL Injection

Exploit Title: Quick.CMS 6.7 SQL Injection Login Bypass Google Dork: N/A Date: 02-03-2024 Exploit Author: ./H4X.Forensics - Diyar Vendor Homepage: https://www.opensolution.org Software Link: https://opensolution.org/download/home.html?sFile=Quick.Cmsv6.7-en.zip Version: 6.7 Tested on: Windows CVE...

CVE-2023-7085 Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG

The Scalable Vector Graphics SVG WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-7085 Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG

The Scalable Vector Graphics SVG WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2024-1331

The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-1333

The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting...

CVE-2024-1333 Responsive Pricing Table < 5.1.11 - Author+ Stored XSS

The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting...

CVE-2024-1333 Responsive Pricing Table < 5.1.11 - Author+ Stored XSS

The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting...

PT-2024-17948 · WordPress · Team Members

Name of the Vulnerable Software and Affected Versions: The Team Members WordPress plugin versions prior to 5.3.2 Description: The issue is related to the lack of validation and escaping of some shortcode attributes in the plugin, which could allow users with the author role and above to perform...

WordPress Plugin Scalable Vector Graphics Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...