WordPress Template Manager for Gutenberg Block plugin <= 1.0.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Template Manager for Gutenberg Block plugin versions = 1.0.5. Solution No patched version available...

WordPress "WordPress Schema Plugin For Divi, Gutenberg & Shortcodes" plugin <= 3.6.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "WordPress Schema Plugin For Divi, Gutenberg & Shortcodes" plugin versions = 3.6.0. Solution No patched version available...

CVE-2022-24665

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts...

CVE-2022-24665

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts...

Code injection

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts...

CVE-2022-24665 Remote Code Execution by by Contributor+ users via WordPress gutenberg block

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts...

CVE-2022-24665 Remote Code Execution by by Contributor+ users via WordPress gutenberg block

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts...

CVE-2022-24665

CVE-2022-24665 affects the WordPress PHP Everywhere plugin

CVE-2022-24665

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Critical remote code execution vulnerabilities in WordPress PHP everywhere Plugin

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Three critical remote code execution RCE vulnerabilities in a WordPress plugin PHP everywhere have been discovered. It is a plugin that allows web developers to utilize PHP code in pages, posts, the sidebar, or anywhere on...

PHP Everywhere < 3.0.0 - Contributor+ RCE via Gutenberg Block

The plugin allows any users with a role as low as contributor to execute PHP via the Gutenberg Block of the plugin in posts...

PHP Everywhere 2.0.3 Remote Code Execution Vulnerability

On January 4, 2022, the Wordfence Threat Intelligence team began the responsible disclosure process for several Remote Code Execution vulnerabilities in PHP Everywhere, a WordPress plugin installed on over 30,000 websites. One of these vulnerabilities allowed any authenticated user of any level,...

PHP Everywhere 2.0.3 Remote Code Execution

On January 4, 2022, the Wordfence Threat Intelligence team began the responsible disclosure process for several Remote Code Execution vulnerabilities in PHP Everywhere, a WordPress plugin installed on over 30,000 websites. One of these vulnerabilities allowed any authenticated user of any level,...

Mars: Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314

The Gutenberg Template Library & Redux Framework plugin version 4.2.11 and below was found to have an unauthenticated sensitive information disclosure vulnerability CVE-2021-38314. The issue was identified where the plugin registered several AJAX actions that were accessible to unauthenticated...

WordPress WooCommerce Gutenberg Blocks Plugin SQL Injection (CVE-2021-32789)

An SQL injection vulnerability exists in WordPress WooCommerce Gutenberg Blocks Plugin. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL statements on the affected system...

WordPress Qubely – Advanced Gutenberg Blocks plugin <= 1.7.7 - Authenticated Post Deletion vulnerability

Authenticated Post Deletion vulnerability discovered by Krzysztof Zając in WordPress Qubely – Advanced Gutenberg Blocks plugin versions = 1.7.7. Solution Update the WordPress Qubely – Advanced Gutenberg Blocks plugin to the latest available version at least 1.7.8...

CVE-2021-24759

The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks...

CVE-2021-42360 Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSS

On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the editposts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block...

Over 1 Million Sites Impacted by Vulnerability in Starter Templates Plugin

On October 4, 2021, the Wordfence Threat Intelligence team initiated the responsible disclosure process for the Starter Templates plugin, which is installed on over 1 Million WordPress websites. The full name of the WordPress plugin is “Starter Templates — Elementor, Gutenberg & Beaver Builder...

PDF.js Viewer < 2.0.2 - Contributor+ Stored Cross-Site Scripting

The plugin does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks PoC pdfjs-viewer searchterm='" onload="alert/XSS/' pdfjs-viewer viewerwidth=0 viewerheight=800 url=undefined...