64 matches found
CVE-2024-30485
CVE-2024-30485 漏洞利用 📌 概述 CVE-2024-30485 是一个高危漏洞，存在于 WordPress 的 Finale Lite 插件中（版本 = 2.18.0）。该漏洞允许已认证用户（Subscriber+）在未经适当授权的情况下安装并激活任意插件。 严重性 : 高危 CVSS 8.8 受影响版本 : Finale Lite = 2.18.0 CWE : CWE-862 缺少授权 🚀 功能 ✅ 检测 WordPress 站点是否存在漏洞 ✅ 使用有效凭证进行身份验证 ✅ 提取安全 nonce ✅ 安装任意插件 ✅ 激活已安装的插件 🛠 要求 Python 3...
CVE-2026-78138
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...
CVE-2026-78138 Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...
WordPress Finale Lite plugin < 2.21.0 - Subscriber+ Campaign Configuration Disclosure vulnerability
Subscriber+ Campaign Configuration Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Finale Lite versions 2.21.0...
EUVD-2026-66883
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...
CVE-2026-78138
CVE-2026-78138 is a missing capability check in the Finale Lite WordPress plugin (versions
CVE-2025-52736
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daman Jeet Finale Lite finale-woocommerce-sales-countdown-timer-discount allows Reflected XSS.This issue affects Finale Lite: from n/a through = 2.20.0...
EUVD-2025-35494
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daman Jeet Finale Lite finale-woocommerce-sales-countdown-timer-discount allows Reflected XSS.This issue affects Finale Lite: from n/a through = 2.20.0...
CVE-2025-52736
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daman Jeet Finale Lite finale-woocommerce-sales-countdown-timer-discount allows Reflected XSS.This issue affects Finale Lite: from n/a through = 2.20.0...
CVE-2025-52736 WordPress Finale Lite Plugin <= 2.20.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daman Jeet Finale Lite finale-woocommerce-sales-countdown-timer-discount allows Reflected XSS.This issue affects Finale Lite: from n/a through = 2.20.0...
CVE-2025-52736
Summary: CVE-2025-52736 affects the WordPress Finale Lite plugin up to version 2.20.0 and is a reflected XSS caused by improper input handling during web page creation. Multiple connected sources confirm the vulnerable component and version range ( Finale Lite: ≤ 2.20.0) and classify the impact a...
CVE-2025-52736 WordPress Finale Lite Plugin <= 2.20.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daman Jeet Finale Lite finale-woocommerce-sales-countdown-timer-discount allows Reflected XSS.This issue affects Finale Lite: from n/a through = 2.20.0...
WordPress plugin Finale Lite 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...
PT-2025-43228
Name of the Vulnerable Software and Affected Versions Daman Jeet Finale Lite versions through 2.20.0 Description The software contains a flaw related to improper input handling during web page creation, which can lead to Reflected Cross-site Scripting XSS. This allows an attacker to inject...
EUVD-2024-16894
Malicious code in bioql PyPI...
EUVD-2024-29929
Malicious code in bioql PyPI...
EUVD-2024-54147
Malicious code in bioql PyPI...
EUVD-2023-51313
Malicious code in bioql PyPI...
WordPress Finale Lite Plugin <= 2.20.0 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by LVT-tholv2k in WordPress Plugin Finale Lite versions = 2.20.0...