CVE-2024-7414 PDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosure

The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-7413 Obfuscate Email <= 3.8.1 - Unauthenticated Full Path Disclosure

The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the...

CVE-2024-7413 Obfuscate Email <= 3.8.1 - Unauthenticated Full Path Disclosure

The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has displayerrors on. This makes it possible for unauthenticated attackers to retrieve the...

CVE-2024-7414 PDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosure

The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-7413

The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to 3.8.1 due to allow direct access to bootstrap.php with display_errors enabled. This enables unauthenticated information exposure (full path) that can assist other vulnerabilities; no exploit detai...

CVE-2024-7414

CVE-2024-7414 affects the PDF Builder for WPForms WordPress plugin. It allows Full Path Disclosure in all versions up to 1.2.116 via direct access to composer-setup.php (display_errors enabled), letting unauthenticated users retrieve the web app’s full path. This information can aid other attacks...

CVE-2024-7382

CVE-2024-7382 concerns the Linkify Text WordPress plugin. The vulnerability is a Full Path Disclosure in all versions up to and including 1.9.1, caused by the plugin using Bootstrap and leaving test files with display_errors enabled. This allows unauthenticated attackers to retrieve the web app’s...

CVE-2024-7382 Linkify Text <= 1.9.1 - Unauthenticated Full Path Disclosure

The Linkify Text plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full path of th...

CVE-2024-7382 Linkify Text <= 1.9.1 - Unauthenticated Full Path Disclosure

The Linkify Text plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full path of th...

WordPress My Custom CSS PHP & ADS plugin <= 3.3 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin My Custom CSS PHP & ADS versions = 3.3...

WordPress Reveal Template plugin <= 3.7 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Reveal Template versions = 3.7...

WordPress No Update Nag plugin <= 1.4.12 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin No Update Nag versions = 1.4.12...

WordPress Linkify Text plugin <= 1.9.1 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Linkify Text versions = 1.9.1...

WordPress Obfuscate Email plugin <= 3.8.1 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Obfuscate Email versions = 3.8.1...

WordPress affiliate-toolkit plugin <= 3.5.5 - Unauthenticated Full Path Dislcosure vulnerability

Unauthenticated Full Path Dislcosure vulnerability discovered by stealthcopter in WordPress Plugin affiliate-toolkit versions = 3.5.5...

PT-2024-38312 · WordPress · Linkify Text

Name of the Vulnerable Software and Affected Versions: Linkify Text plugin for WordPress versions up to and including 1.9.1 Description: The issue is related to Full Path Disclosure, which occurs because the plugin uses bootstrap and leaves test files with display errors enabled. This allows...

PT-2024-38330 · WordPress · Pdf Builder For Wpforms

Name of the Vulnerable Software and Affected Versions: PDF Builder for WPForms plugin for WordPress versions up to, and including, 1.2.116 Description: The issue is related to Full Path Disclosure, which occurs because the plugin allows direct access to the composer-setup.php file with display...

PT-2024-38326 · WordPress · My Custom Css Php & Ads

Name of the Vulnerable Software and Affected Versions: My Custom CSS PHP & ADS plugin for WordPress versions up to, and including, 3.3 Description: The issue is related to Full Path Disclosure, which occurs because the plugin does not prevent direct access to the...

CVE-2024-6552

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2. This is due to the plugin utilizing Symfony and leaving displayerrors on within test files. This makes it possible for unauthenticated...

CVE-2024-6552

CVE-2024-6552 affects Booking for Appointments and Events Calendar – Amelia (WordPress). It is a Full Path Disclosure vulnerability in all versions up to 1.2 due to Symfony usage and display_errors left on in test files, allowing unauthenticated attackers to retrieve the web app’s full filesystem...