WordPress ClickCease Click Fraud Protection plugin <= 3.2.4 - Improper Authorization to sensitive information exposure via get_settings vulnerability

Improper Authorization to sensitive information exposure via getsettings vulnerability discovered by Francesco Carlucci in WordPress Plugin ClickCease Click Fraud Protection versions = 3.2.4...

CVE-2024-3849

The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible for authenticated attackers, with contributor access or above, to include and execute arbitrary files on the server, allowing the execution ...

CVE-2024-3849 Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion

The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible for authenticated attackers, with contributor access or above, to include and execute arbitrary files on the server, allowing the execution ...

CVE-2024-3849: Improper Control of Filename for Include/Require Statement in PHP Program

The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible for authenticated attackers, with contributor access or above, to include and execute arbitrary files on the server, allowing the execution ...

CVE-2024-2667: Unrestricted Upload of File with Dangerous Type

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

PT-2024-28030 · WordPress · Click To Chat – Holithemes

Name of the Vulnerable Software and Affected Versions: Click to Chat – HoliThemes plugin for WordPress versions up to, and including, 3.35 Description: The issue allows authenticated attackers with contributor access or above to include and execute arbitrary files on the server. This enables the...

CVE-2024-24978: Undefined Security Weakness

Denial-of-service DoS vulnerability exists in TvRock 0.9t8a. Receiving a specially crafted request by a remote attacker or having a user of TvRock click a specially crafted request may lead to ABEND abnormal end. Note that the developer was unreachable, therefore, users should consider stop using...

PT-2024-24463

Name of the Vulnerable Software and Affected Versions LOGINT LoMag Inventory Management versions 1.0.20.120 and before Description The issue allows an attacker to execute arbitrary code via the ArticleGetGroups, DocAddDocument, ClassClickShop, and frmSettings components. This is a SQL Injection...

CVE-2024-33678

Cross-Site Request Forgery CSRF vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection.This issue affects ClickCease Click Fraud Protection: from n/a through = 3.2.7...

CVE-2024-33678

CVE-2024-33678 corresponds to a Cross-Site Request Forgery (CSRF) vulnerability in the ClickCease Click Fraud Protection plugin by eranfl. Public records note this affects ClickCease Click Fraud Protection releases up to version 3.2.7 (no fixed version disclosed in the provided documents). The Re...

WordPress ClickCease Click Fraud Protection Plugin <= 3.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software ClickCease Click Fraud Protection Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-33678 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c376a3fb1460 Credits...

CVE-2024-33678: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection.This issue affects ClickCease Click Fraud Protection: from n/a through = 3.2.7...

WordPress plugin ClickCease Click Fraud Protection 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists...

Google ad for Facebook redirects to scam

Today, we are looking at a malicious ad campaign targeting Facebook users via Google search. It is well-known that tech support scammers attract new victims by buying ads for certain keywords related to their audience. What is perhaps less known is how it is even possible to impersonate top brand...

CVE-2024-0900: Missing Authorization

The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress is vulnerable to unauthorized post creation due to a missing capability check on the elesparecreatepost function hooked via AJAX in all...

WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Olive One Click Demo Import versions = 1.1.1...

WordPress Olive One Click Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File Download

Software Olive One Click Demo Import Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-32715 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID a4c06fc8a3c4 Credits Yudistira Arya...

WordPress Click to Chat plugin <= 3.35 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by haidv35 from Viettel Cyber Security in WordPress Plugin Click to Chat versions = 3.35...

WordPress Click to Chat Plugin <= 3.35 is vulnerable to Local File Inclusion

Software Click to Chat Type Plugin Vulnerable versions = 3.35 Fixed in 4.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3849 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 3a9b57b69a7e Credits haidv35 from Viettel Cyber Security Required...

WordPress WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin <= 7.0 - Sensitive Information Exposure via insufficiently protected files vulnerability

Sensitive Information Exposure via insufficiently protected files vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content versions = 7.0...