WordPress Premium Portfolio Features for Phlox theme plugin <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ' Grid Portfolios' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via ' Grid Portfolios' vulnerability discovered by wesley wcraft in WordPress Plugin Phlox Portfolio versions = 2.3.2...

PT-2024-26765 · WordPress · Premium Portfolio Features For Phlox

Name of the Vulnerable Software and Affected Versions: Premium Portfolio Features for Phlox theme plugin for WordPress versions up to, and including, 2.3.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget due to insufficient input sanitizati...

CVE-2024-3587: Improper Neutralization of Input During Web Page Generation

The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

WordPress Image Photo Gallery Final Tiles Grid plugin < 3.6.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Image Photo Gallery Final Tiles Grid versions 3.6.0...

WordPress Image Photo Gallery Final Tiles Grid Plugin < 3.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Image Photo Gallery Final Tiles Grid Type Plugin Vulnerable versions 3.6.0 Fixed in 3.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3710 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID af002133dcff Credits Dmitr...

CVE-2024-3710

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be use...

CVE-2024-3710

The Image Photo Gallery Final Tiles Grid WordPress plugin, in versions prior to 3.6.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to properly validate and escape certain shortcode attributes before outputting them back to the page. This flaw allow...

CVE-2024-3710: Improper Neutralization of Input During Web Page Generation

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be use...

Malicious code in two-column-image-text-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 816a60cffab8a3e09e7bdd3135a8d8fdb6bca092a94ec723a64d7aecd057d471 The OpenSSF Package Analysis project identified 'two-column-image-text-grid' @ 69.69.69 npm as malicious. It is considered malicious because: -...

MAL-2024-7695 Malicious code in two-column-image-text-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 816a60cffab8a3e09e7bdd3135a8d8fdb6bca092a94ec723a64d7aecd057d471 The OpenSSF Package Analysis project identified 'two-column-image-text-grid' @ 69.69.69 npm as malicious. It is considered malicious because: -...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.5.0 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

WordPress FancyPost Plugin <= 5.3.1 is vulnerable to Cross Site Scripting (XSS)

Software FancyPost Type Plugin Vulnerable versions = 5.3.1 Fixed in 5.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38686 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 64272ac7505f Credits 4rCanJ0x! Required privilege Author Publishe...

PT-2024-27469 · Everest · Everest

Name of the Vulnerable Software and Affected Versions: EVerest versions prior to 2024.3.1 EVerest versions prior to 2024.6.0 Description: EVerest is an EV charging software stack. An integer overflow in the v2g incoming v2gtp function in the v2g server.cpp implementation can allow a remote attack...

WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin The Post Grid versions = 7.7.4...

WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin The Post Grid versions = 7.7.4...

WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin The Post Grid versions = 7.7.4...

CVE-2024-3639

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Posts Grid widget in all versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3639 Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid

The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Posts Grid widget in all versions up to, and including, 8.3.7 due to insufficient input sanitization and output escaping on user supplied attributes like 'gridskin'. This makes it...

WordPress The Post Grid Plugin <= 7.7.4 is vulnerable to Broken Access Control

Software The Post Grid Type Plugin Vulnerable versions = 7.7.4 Fixed in 7.7.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37483 Patch priority Low CVSS severity Low 5.4 Developer Mamunur Rashid PSID 74cdae3737f6 Credits Rafie Muhammad Patchstack Requir...

PT-2024-26965 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.3.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Posts Grid widget due to insufficient input sanitization and output...