CVE-2024-2842

CVE-2024-2842 concerns the WordPress plugin Easy Appointments. The vulnerability is a Stored Cross-Site Scripting flaw in the plugin’s ea_full_calendar shortcode, caused by insufficient input sanitization and output escaping on user-supplied attributes. Affected versions are all versions up to an...

CVE-2024-2844

CVE-2024-2844 concerns the Easy Appointments WordPress plugin. The vulnerability arises from insufficient user validation in ajax_cancel_appointment(), allowing an unauthenticated attacker to cancel other users’ orders. Affected version range includes all versions up to and including 3.11.18. The...

CVE-2024-2842 Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'eafullcalendar' shortcode in all versions up to, and including, 3.11.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-2844 Easy Appointments <= 3.11.18 - Insufficient Authorization

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajaxcancelappointment function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders...

CVE-2024-2844 Easy Appointments <= 3.11.18 - Insufficient Authorization

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajaxcancelappointment function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders...

WordPress Easy Social Feed Plugin <= 6.5.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy Social Feed Type Plugin Vulnerable versions = 6.5.6 Fixed in 6.5.7 OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-30526 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f199cb78a406 Credits Brandon Roldan Required...

WordPress Plugin Easy Appointments 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Easy Appointments Plugin <= 3.11.18 is vulnerable to Broken Access Control

Software Easy Appointments Type Plugin Vulnerable versions = 3.11.18 Fixed in 3.11.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-2844 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d5cb3e5ca959 Credits Krzysztof Zając Required...

WordPress Plugin Easy Appointments 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Easy Form Builder Plugin <= 3.7.4 is vulnerable to SQL Injection

Software Easy Form Builder Type Plugin Vulnerable versions = 3.7.4 Fixed in 3.7.5 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30535 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID f429d841104c Credits LVT-tholv2k Required privilege Contributor...

WordPress Easy Appointments Plugin <= 3.11.18 is vulnerable to Cross Site Scripting (XSS)

Software Easy Appointments Type Plugin Vulnerable versions = 3.11.18 Fixed in 3.11.19 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2842 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e349d86a643f Credits Krzysztof Zając...

PT-2024-22436 · WordPress · Easyappointments

Name of the Vulnerable Software and Affected Versions: Easy Appointments plugin for WordPress versions up to, and including, 3.11.18 Description: The issue arises from insufficient user validation on the ajax cancel appointment function, allowing unauthenticated attackers to cancel other users'...

PT-2024-22424 · WordPress · Easyappointments

Name of the Vulnerable Software and Affected Versions: Easy Appointments plugin for WordPress versions up to, and including, 3.11.18 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'ea full calendar' shortcode due to insufficient input sanitization and output...

Easy Appointments < 3.11.19 - Insufficient Authorization

Description The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajaxcancelappointment function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other...

WordPress RT Easy Builder – Advanced addons for Elementor Plugin <= 2.0 is vulnerable to Broken Access Control

Software RT Easy Builder – Advanced addons for Elementor Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30484 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 63af1e863062 Credits...

CVE-2024-30180

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Social Feed allows Stored XSS.This issue affects Easy Social Feed: from n/a through 6.5.3...

CVE-2024-30180

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Social Feed allows Stored XSS.This issue affects Easy Social Feed: from n/a through 6.5.3...

CVE-2024-30180

The CVE CVE-2024-30180 concerns an Improper Neutralization of Input During Web Page Generation (Stored XSS) in the WordPress plugin Easy Social Feed – Social Photos Gallery – Post Feed – Like Box. Publicly disclosed details indicate the vulnerability affects Easy Social Feed versions up to 6.5.3 ...

CVE-2024-30180 WordPress Easy Social Feed plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Social Feed allows Stored XSS.This issue affects Easy Social Feed: from n/a through 6.5.3...

CVE-2024-30180 WordPress Easy Social Feed plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Easy Social Feed allows Stored XSS.This issue affects Easy Social Feed: from n/a through 6.5.3...