WordPress WP Category Dropdown plugin <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via align Parameter vulnerability discovered by Francesco Carlucci in WordPress Plugin WP Category Dropdown versions = 1.8...

WordPress WP Category Dropdown Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Category Dropdown Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8103 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 756b0ad9d0a7 Credits Francesco Carlucci...

PT-2024-38803 · WordPress · Wp Category Dropdown

Name of the Vulnerable Software and Affected Versions: WP Category Dropdown plugin for WordPress version 1.8 and earlier Description: The issue is related to Stored Cross-Site Scripting via the align parameter due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2024-6521: Improper Neutralization of Input During Web Page Generation

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dropdown fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it...

Malicious code in console3-dropdown (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2020 Malicious code in console3-dropdown (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-40445 · Silverstripe · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: Silverstripe CMS affected versions not specified Description: A cross-site scripting issue has been found in the TreeDropdownField and TreeMultiSelectField. This can be exploited if a user with CMS access posts malicious or unescaped HTML int...

PT-2024-40342 · Packagist · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A high-level XSS risk has been identified in the encoding of validation messages in certain FormField classes. This issue affects form fields that present invalid content as part of...

CVE-2024-3495

CVE-2024-3495 : WordPress plugin Country State City Dropdown CF7 (

WordPress Country State City Dropdown CF7 plugin <= 2.7.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin Country State City Dropdown CF7 versions = 2.7.2...

WordPress Country State City Dropdown CF7 Plugin <= 2.7.2 is vulnerable to SQL Injection

Software Country State City Dropdown CF7 Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3495 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 39d467a76c0d Credits Krzysztof Zając Required privile...

CVE-2024-3495: Improper Neutralization of Special Elements used in an SQL Command

The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

PT-2024-26266

Name of the Vulnerable Software and Affected Versions Country State City Dropdown CF7 plugin for WordPress versions up to and including 2.7.2 Description The Country State City Dropdown CF7 plugin for WordPress is susceptible to SQL Injection through the cnt and sid parameters. Insufficient input...

PT-2024-26377 · WordPress · Country State City Dropdown Cf7

Name of the Vulnerable Software and Affected Versions: The Country State City Dropdown CF7 plugin for WordPress versions up to, and including, 2.7.1 Description: The issue allows authenticated attackers with subscriber access and above to modify data without proper authorization. This is due to a...

CVE-2024-3520: Missing Authorization

The Country State City Dropdown CF7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tccscapatchsettings function in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with subscriber access...

CVE-2024-32126 WordPress Navigation menu as dropdown Widget plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeroen Peters Navigation menu as Dropdown Widget navigation-menu-as-dropdown-widget.This issue affects Navigation menu as Dropdown Widget: from n/a through = 1.3.4...

CVE-2024-32126

CVE-2024-32126 concerns an XSS issue in the WordPress plugin Navigation menu as Dropdown Widget (

PT-2024-24420 · Unknown · Navigation Menu As Dropdown Widget

Name of the Vulnerable Software and Affected Versions: Navigation menu as Dropdown Widget versions 1.3.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can...

WordPress Plugin Navigation Menu as a Dropdown Widget Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

CVE-2024-32126: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeroen Peters Navigation menu as Dropdown Widget navigation-menu-as-dropdown-widget.This issue affects Navigation menu as Dropdown Widget: from n/a through = 1.3.4...