PT-2024-33558 · WordPress · Advanced Custom Fields Pro +1

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields ACF versions prior to 6.3.9 Secure Custom Fields versions prior to 6.3.6.3 Description: The issue allows for the execution of a stored XSS payload when using the Field Group editor to edit one of the plugin's fields in...

WordPress 跨站脚本漏洞

WordPress is a suite of blogging platforms developed in the PHP language by the WordPress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in WordPress version 6.0.2 and earlier versions, which stems from the...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

PT-2024-11910 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress Core versions up to 6.0.2 Description: The issue allows users with access to the WordPress post and page editor, typically Authors, Contributors, and Editors, to inject arbitrary web scripts into posts and pages. These scripts execu...

ROS-20241015-05

Nano text editor vulnerability is related to temporary file handling errors. Exploitation exploitation of the vulnerability could allow an attacker to affect data integrity...

VulnCheck KEV: CVE-2022-4973

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into...

WordPress Htaccess File Editor plugin <= 1.0.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Htaccess File Editor versions = 1.0.18...

WordPress WPIDE – File Manager & Code Editor Plugin <= 3.4.9 is vulnerable to Full Path Disclosure (FPD)

Software WPIDE – File Manager & Code Editor Type Plugin Vulnerable versions = 3.4.9 Fixed in 3.5.0 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-9546 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 611d26fe2e96 Credits TANG...

WordPress Htaccess File Editor Plugin <= 1.0.18 is vulnerable to Broken Access Control

Software Htaccess File Editor Type Plugin Vulnerable versions = 1.0.18 Fixed in 1.0.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49256 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d6dd94150ebc Credits savphill Require...

WordPress ShortPixel Image Optimizer Plugin <= 5.6.3 is vulnerable to SQL Injection

Software ShortPixel Image Optimizer Type Plugin Vulnerable versions = 5.6.3 Fixed in 5.6.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-48043 Patch priority Low CVSS severity Low 7.6 Developer ShortPixel PSID d284fe203395 Credits Rafie Muhammad Patchstack Required privileg...

CVE-2024-7489 Forms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters

The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form color parameters in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for...

PDF-XChange Editor EMF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. PDF-XChange Editor EMF file parsing there are out-of-bounds read information leakage vulnerability, an attacker can exploit the vulnerability to obtain sensitive information...

PDF-XChange Editor JPG File Parsing Out-of-Bounds Read Remote Code Execution Vulnerability

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. An out-of-bounds read remote code execution vulnerability exists in PDF-XChange Editor JPG file parsing, which can be exploited by an attacker to execute code in the context of the...

WordPress UserPlus plugin <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation vulnerability

Authenticated Editor+ Registration Form Update to Privilege Escalation vulnerability discovered by István Márton in WordPress Plugin UserPlus versions = 2.0...

MAL-2024-9244 Malicious code in prismjs-editor-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 040f9d206fa46c86f67191c2a1777918670867a6e0888635b2f08567360ba10f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in prismjs-editor-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 040f9d206fa46c86f67191c2a1777918670867a6e0888635b2f08567360ba10f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9519

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'savemetaboxform' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update t...

CVE-2024-9519 UserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'savemetaboxform' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update t...

SUSE CVE-2024-47814

Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a buffer visible in a window a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user...