WordPress Easy Tiktok Feed plugin <= 1.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Tiktok Feed plugin versions = 1.1.0. Solution Update the WordPress Easy Tiktok Feed plugin to the latest available version at least 1.1.1...

WordPress Easy Digital Downloads – Courses plugin <= 0.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Easy Digital Downloads – Courses plugin versions = 0.1.0. Solution Update the WordPress Easy Digital Downloads – Courses plugin to the latest available version at least 0.1.1...

WordPress Easy Code Snippets plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Code Snippets plugin versions = 1.0.0. Solution Update the WordPress Easy Code Snippets plugin to the latest available version at least 1.0.1...

WordPress Easy Social Photos Gallery – MIF plugin <= 3.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Social Photos Gallery – MIF plugin versions = 3.1.0. Solution Update the WordPress Easy Social Photos Gallery – MIF plugin to the latest available version at least 3.1.1...

WordPress Easy Age Verify plugin < 1.6.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Age Verify plugin versions 1.6.3. Solution Update the WordPress Easy Age Verify plugin to the latest available version at least 1.6.3...

WordPress Bulk Edit Easy Digital Downloads – Fast Bulk Creator plugin < 1.0.49 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Bulk Edit Easy Digital Downloads – Fast Bulk Creator plugin versions 1.0.49. Solution Update the WordPress Bulk Edit Easy Digital Downloads – Fast Bulk Creator plugin to the latest available version at...

WordPress Bulk Edit Easy Digital Downloads – Fast Bulk Creator plugin < 1.0.49 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Bulk Edit Easy Digital Downloads – Fast Bulk Creator plugin versions 1.0.49. Solution Update the WordPress Bulk Edit Easy Digital Downloads – Fast Bulk Creator plugin to the latest available version at least 1.0.49...

WordPress Google Sheet Connector for Easy Digital Downloads plugin <= 1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Google Sheet Connector for Easy Digital Downloads plugin versions = 1.2. Solution Update the WordPress Google Sheet Connector for Easy Digital Downloads plugin to the latest available version at least...

Use after free in Animation

Use after free in Animation. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available...

Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRF

The plugin does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in the trash PoC https://example.com/wp-admin/edit.php?posttype=easy-pricing-table=ept3-list=trash=1...

Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRF

The plugin does not verify the CSRF nonce when removing posts, allowing attackers to make a logged in admin remove arbitrary posts from the blog via a CSRF attack, which will be put in the trash https://example.com/wp-admin/edit.php?posttype=easy-pricing-table&page=ept3-list&action=trash&post=1...

WordPress Easy Forms for Mailchimp Plugin < 6.8.6 XSS Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Easy Forms for Mailchimp plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the Easy Forms for Mailchimp plugin for...

CVE-2021-24985

The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the fieldname and fieldtype parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

Cross site scripting

The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the fieldname and fieldtype parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

CVE-2021-24985 Easy Forms for Mailchimp < 6.8.6 - Reflected Cross-Site Scripting

The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the fieldname and fieldtype parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

CVE-2021-24985

CVE-2021-24985 affects WordPress plugin Easy Forms for Mailchimp prior to version 6.8.6. The issue arises because field_name and field_type are not sanitized/escaped when echoed back in attributes, enabling Reflected XSS. The Red Hat and CVE records corroborate this description; remediation is to...

[SECURITY] Fedora 34 Update: prosody-0.11.12-1.fc34

Prosody is a flexible communications server for Jabber/XMPP written in Lua. It aims to be easy to use, and light on resources. For developers it aims to be easy to extend and give a flexible system on which to rapidly develop added functionality, or prototype new protocols...

CVE-2022-21265

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

WordPress Plugin Events Made Easy SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Events Made Easy. The vulnerability stems from the program not properly filtering and...