CVE-2024-4385

The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

CVE-2024-35727

Missing Authorization vulnerability in actpro Extra Product Options for WooCommerce.This issue affects Extra Product Options for WooCommerce: from n/a through 3.0.6...

CVE-2024-53802

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through = 2.0.14...

CVE-2024-10695

The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-10770

The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2023-30929

In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges...

CVE-2023-46079

Missing Authorization vulnerability in WP Royal Ashe Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe Extra: from n/a through 1.2.9...

CVE-2023-0749

The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones...

CVE-2023-35877

Cross-Site Request Forgery CSRF vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: from n/a through 0.5...

CVE-2023-47658

Auth. ShopManager+ Stored Cross-Site Scripting XSS vulnerability in actpro Extra Product Options for WooCommerce plugin = 3.0.3 versions...

CVE-2023-47825

Cross-Site Request Forgery CSRF vulnerability in TienCOP WP EXtra plugin = 6.4 versions...

CVE-2023-49164

Cross-Site Request Forgery CSRF vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2...

CVE-2023-46212

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2...

CVE-2023-46623

Improper Control of Generation of Code 'Code Injection' vulnerability in TienCOP WP EXtra.This issue affects WP EXtra: from n/a through 6.2...

CVE-2023-35878

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Vadym K. Extra User Details plugin = 0.5 versions...

CVE-2023-23520

A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read arbitrary files as root...

CVE-2023-21383

In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2023-30927

In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-23891

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in OceanWP Ocean Extra plugin = 2.1.1 versions. Needs the OceanWP theme installed and activated...

Malicious code in document-list-extra-questions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17f311a1014dd39c97963383ae0240c9ced38e74b96e8b880acd9c1bf8974c56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...