WordPress Post Grid and Gutenberg Blocks Plugin <= 2.2.78 is vulnerable to Sensitive Data Exposure

Software Post Grid and Gutenberg Blocks Type Plugin Vulnerable versions = 2.2.78 Fixed in 2.2.79 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-32816 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 4274dff100bf Credits Peng Zho...

CVE-2024-32564

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through = 4.0.1...

CVE-2024-32564 WordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through = 4.0.1...

CVE-2024-32564

CVE-2024-32564 affects Post Grid Gutenberg Blocks and PostX (Post Grid for WordPress) with a Stored XSS in Post Grid blocks (improper input neutralization during page generation). Affected versions: PostX – Gutenberg Blocks for Post Grid up to 4.0.1. Root cause: improper neutralization of input; ...

PT-2024-24685 · WordPress · Postx – Gutenberg Blocks For Post Grid

Name of the Vulnerable Software and Affected Versions: PostX – Gutenberg Blocks for Post Grid versions through 4.0.1 Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for stored XSS. Recommendations: F...

Oracle Database Server (Apr 2024 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory. - Vulnerability in the RDBMS Python component of Oracle Database Server. Supported versions that are affected are 21.3-21.13. Easily exploitab...

HT Mega < 2.5.0 - Contributor+ Stored XSS via Image Grid Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the Image Grid widget's attributes due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages th...

Otter Blocks < 2.6.10 - Contributor+ Stored XSS via titleTag

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Post Grid widget due to insufficient input sanitization and output escaping on user supplied attributes such as 'titleTag'. This makes it possible for authenticated attackers, with contributor-level access and...

WordPress PostX Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

Software PostX Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2024-32564 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 904b17651379 Credits CatFather Required privilege...

WordPress Advanced Post Block - Post Grid for WordPress block editor Plugin <= 1.13.4 is vulnerable to Broken Access Control

Software Advanced Post Block - Post Grid for WordPress block editor Type Plugin Vulnerable versions = 1.13.4 Fixed in 1.13.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0908 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

Xibo 安全漏洞

Xibo is a content management system open source by Xibo Digital Signage. A security vulnerability exists in Xibo CMS that stems from the ability to perform session hijacking via cross-site scripting XSS attacks in the header and session grid...

CVE-2024-0881

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to rea...

CVE-2024-0881 Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to rea...

WordPress Essential Grid plugin <= 3.1.1 - Unauthenticated Private Post Disclosure vulnerability

Unauthenticated Private Post Disclosure vulnerability discovered by 1337Wannabe in WordPress Plugin Essential Grid versions = 3.1.1...

Wordpress Responsive Gallery Grid plugin < 2.3.11 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by WPScan in WordPress Plugin Responsive Gallery Grid versions 2.3.11...

WordPress Responsive Gallery Grid Plugin < 2.3.11 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Gallery Grid Type Plugin Vulnerable versions 2.3.11 Fixed in 2.3.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1664 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 64e1e4491d20 Credits WPScan Required...

WordPress Essential Grid Plugin <= 3.1.1 is vulnerable to Broken Access Control

Software Essential Grid Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3235 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 597aadc22d06 Credits 1337Wannabe Required privilege...

CVE-2024-3235

CVE-2024-3235 affects the Essential Grid Gallery WordPress Plugin (WordPress plugin name: Essential Grid) with a Sensitive Information Exposure in the on_front_ajax_action() path. All versions up to 3.1.1 are vulnerable, allowing unauthenticated attackers to view private and password-protected po...