CVE-2024-9872 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitasaveuserdatacallback function in all versions up to, and including, 4.5.1. This makes it possible for authenticated...

CVE-2024-11323

CVE-2024-11323 affects the WordPress plugin AI Quiz | Quiz Maker (≤1.1). The root cause is a missing capability check in ai_quiz_update_style(), allowing authenticated users with Subscriber+ privileges to modify arbitrary options and potentially escalate to admin by changing default registration ...

CVE-2024-11323 AI Quiz | Quiz Maker <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the aiquizupdatestyle function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers,...

CVE-2024-9705

CVE-2024-9705 affects the Ultimate Coming Soon & Maintenance plugin for WordPress (versions up to and including 1.0.9). The vulnerability is a missing capability check in ucsm_update_template_name_lite that allows authenticated attackers with Subscriber+ privileges to modify template names. Multi...

PT-2024-39902 · WordPress · Online Booking & Scheduling Calendar For Wordpress

Name of the Vulnerable Software and Affected Versions: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress versions up to, and including, 4.5.1 Description: The issue is related to a missing capability check on the vcita save user data callback function, allowing...

WordPress plugin Gold Addons for Elementor has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blogging sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin Message Filter for Contact Form has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

WordPress Plugin AI Quiz | Quiz Maker Security Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin “Online Booking & Scheduling Calendar for WordPress” by vcita – Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

CVE-2024-10567

CVE-2024-10567 affects the TI WooCommerce Wishlist WordPress plugin (versions up to 2.9.1). The issue is a missing capability check in the wizard function, enabling unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates. The vulnerability is doc...

CVE-2024-10664

The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the basepressdbpostsupdate function in all versions up to, and including, 2.16.3.3. This makes it possible for authenticated...

CVE-2024-10664

CVE-2024-10664 – BasePress Docs (Knowledge Base documentation & wiki plugin) for WordPress is affected by a missing authorization check in basepress_db_posts_update(), enabling data modification by authenticated users with Subscriber-level access and above, across all versions up to 2.16.3.3. Pub...

CVE-2024-10663

CVE-2024-10663 concerns Eleblog – Elementor Blog And Magazine Addons for WordPress (versions up to 1.8). A missing capability check in goodbye_form_callback() enables unauthenticated? no, this requires authenticated Subscriber+ access to modify data by submitting a deactivation reason. The CVE no...

WordPress plugin BasePress: security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-16439 · WordPress · Eleblog

Name of the Vulnerable Software and Affected Versions: Eleblog – Elementor Blog And Magazine Addons plugin for WordPress versions up to, and including, 1.8 Description: The issue is related to a missing capability check on the goodbye form callback function, allowing authenticated attackers with...

WordPress plugin TI WooCommerce Wishlist has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-51773

A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting XSS attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized t...

CVE-2024-51773

CVE-2024-51773 affects Hewlett Packard Enterprise Aruba ClearPass Policy Manager web-based management interface. A stored XSS vulnerability allows an authenticated remote attacker to perform actions within the user’s permissions, potentially accessing data, modifying or deleting information, and ...

CVE-2024-11844

The CVE-2024-11844 entry concerns the IdeaPush WordPress plugin (versions up to and including 8.71). Root cause: missing capability check in the idea_push_taxonomy_save_routine allows authenticated users with Subscriber-level access or higher to delete terms in the boards taxonomy, effectively en...