WordPress plugin Envo Extra security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-5645: Improper Neutralization of Input During Web Page Generation

The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttoncssid’ parameter within the Button widget in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

WordPress Extra Product Options for WooCommerce plugin <= 3.0.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Extra Product Options for WooCommerce versions = 3.0.6...

CVE-2024-32976

Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input...

PT-2024-25023 · Unknown · Envoyproxy

Name of the Vulnerable Software and Affected Versions: Envoyproxy affected versions not specified Description: The issue arises when Envoyproxy, equipped with a Brotli filter, encounters an endless loop during the decompression of Brotli data that contains extra input. This can occur in Envoy, a...

CVE-2024-5501

The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttononeid’ parameter in all versions up to, and including, 2.5.51 due to insufficient input sanitization and output escaping. This makes it possible for...

vantage6 collaboration admins can extend their influence by expanding the collaboration

Impact Collaboration administrators can add extra organizations to their collaboration. When doing that, they extend their influence: for instance, for organizations that they include, they can then create new users for which they know the passwords, and use that to read task results of other...

GHSA-WW6P-Q26W-FR6M phpxmlrpc/extra XSS in class documenting_xmlrpc_server

Versions preceding 0.6.1 of the phpxmlrpc/extras project are susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability exists within the class documentingxmlrpcserver when processing the GET methodName parameter...

GHSA-WGJV-9J3Q-JHG8 aiosmtpd STARTTLS unencrypted commands injection

Summary Servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a MitM attack. References NO STARTTLS: Similar vulnerabilities discovered by previous researchers...

CVE-2024-31974

The com.solarized.firedown aka Solarized FireDown Browser & Downloader application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. com.solarized.firedown.IntentActivity uses a WebView component to display web content and doesn't adequately...

CVE-2023-37888: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0...

CVE-2024-4385

The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

CVE-2024-4385 Envo Extra <= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting

The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

CVE-2024-4385

CVE-2024-4385 affects the Envo Extra WordPress plugin (up to v1.8.16). It enables Stored XSS via multiple parameters due to insufficient input sanitization/output escaping. Exploitation requires authentication at contributor level or higher, enabling injection of scripts into pages viewed by user...

CVE-2024-4385 Envo Extra <= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting

The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

WordPress Envo Extra plugin <= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting vulnerability

Authenticated Contributor+ Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin Envo Extra versions = 1.8.16...

WordPress Envo Extra Plugin <= 1.8.16 is vulnerable to Cross Site Scripting (XSS)

Software Envo Extra Type Plugin Vulnerable versions = 1.8.16 Fixed in 1.8.17 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4385 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID da986c13aa90 Credits stealthcopter Required...

PT-2024-30709

Name of the Vulnerable Software and Affected Versions Envo Extra plugin for WordPress versions up to, and including, 1.8.16 Description The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters due to insufficient input sanitization and output...

CVE-2024-4385: Improper Neutralization of Input During Web Page Generation

The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and...

WordPress plugin Envo Extra plugin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...