PT-2024-37431 · WordPress · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: The Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.112 Description: The issue is related to IP Address Spoofing due to insufficient IP address validation and/or use of user-supplied HTTP headers as a...

The vulnerability of SAP Document Builder in creating and managing documents allows for unlimited uploading of sensitive files, enabling an attacker to gain access to read, modify, or delete data.

The vulnerability of SAP Document Builder for document creation and management lies in its ability to allow unlimited uploading of sensitive files. Exploiting this vulnerability could enable a malicious actor to gain read, modify, or delete access to data...

CVE-2024-37554

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in CodeAstrology Team UltraAddons Elementor Lite Header & Footer Builder, Menu Builder, Cart Icon, Shortcode.This issue affects UltraAddons Elementor Lite Header & Footer Builder, Menu Builder,...

CVE-2024-37554

The CVE-2024-37554 entry concerns the WordPress plugin UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode) with versions up to 1.1.6. The underlying issue is Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting (XSS). Affecte...

New Mallox Ransomware Variant Targets Linux Systems

New variant of Mallox ransomware targets Linux systems using custom encryption and a builder web panel. Cybersecurity researchers…...

WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.10 is vulnerable to Cross Site Scripting (XSS)

Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions = 8.5.10 Fixed in 8.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37512 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6818a3b8cb82 Credits LVT-tholv2k Require...

WordPress ShopBuilder – Elementor WooCommerce Builder Addons Plugin <= 2.1.12 is vulnerable to Local File Inclusion

Software ShopBuilder – Elementor WooCommerce Builder Addons Type Plugin Vulnerable versions = 2.1.12 Fixed in 2.1.13 OWASP Top 10 A6: Security Misconfiguration Classification Local File Inclusion CVE CVE-2024-37520 Patch priority Low CVSS severity Low 6.5 Developer Mamunur Rashid PSID 818612bafe4...

WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Beaver Builder versions = 2.8.2.2...

WordPress Beaver Builder Plugin <= 2.8.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Beaver Builder Type Plugin Vulnerable versions = 2.8.2.2 Fixed in 2.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37500 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a2cc031cf30b Credits João Pedro S Alcântara Kinorth Requir...

WordPress WPQA plugin < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF vulnerability

Arbitrary Category and Tag Follow/Unfollow via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin WPQA - Builder forms Addon versions 6.1.1...

WordPress WPQA plugin < 6.1.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WPQA - Builder forms Addon versions 6.1.1...

WordPress OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) plugin <= 1.1.2 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin OpenStreetMap for Gutenberg and WPBakery Page Builder formerly Visual Composer versions = 1.1.2...

CVE-2024-2376

The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-2375

The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-2375

The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-2376

The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-2375 WPQA < 6.1.1 - Contributor+ Stored XSS

The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-2376 WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF

The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-2376

The CVE-2024-2376 issue affects the WordPress WPQA Builder plugin prior to version 6.1.1, where CSRF checks are missing in some areas. This allows authenticated attackers to trigger actions on behalf of logged-in users (e.g., Arbitrary Category and Tag Follow/Unfollow), as documented by multiple ...

CVE-2024-2376 WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF

The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...