PT-2024-23233 · Ht Mega · Ht Mega

Name of the Vulnerable Software and Affected Versions: HT Mega versions through 2.4.3 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject malicious scripts into the...

WordPress Plugin HT Mega 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress HT Mega Plugin <= 2.4.3 is vulnerable to Cross Site Scripting (XSS)

Software HT Mega Type Plugin Vulnerable versions = 2.4.3 Fixed in 2.4.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30182 Patch priority Low CVSS severity Low 6.5 Developer HTMega PSID 0451a481cb52 Credits Khalid Yusuf Required privilege Contributor Published 2...

HT Easy GA4 ( Google Analytics 4 ) < 1.1.8 - Reflected Cross-Site Scripting

Description The HT Easy GA4 Google Analytics 4 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘functionorparam’ parameter in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-29094

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes HT Easy GA4 Google Analytics 4 allows Stored XSS.This issue affects HT Easy GA4 Google Analytics 4 : from n/a through 1.1.7...

CVE-2024-29094 WordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes HT Easy GA4 Google Analytics 4 allows Stored XSS.This issue affects HT Easy GA4 Google Analytics 4 : from n/a through 1.1.7...

CVE-2024-29094 WordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes HT Easy GA4 Google Analytics 4 allows Stored XSS.This issue affects HT Easy GA4 Google Analytics 4 : from n/a through 1.1.7...

CVE-2024-29094

CVE-2024-29094 relates to HT Easy GA4 (HasThemes) for WordPress, vulnerability type: Stored XSS due to Improper Neutralization of Input During Web Page Generation. Affected software: HT Easy GA4 (Google Analytics 4) plugin; affected range: from n/a through version 1.1.7. The impact is stored cros...

WordPress Plugin HT Easy GA4 Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin HT Easy GA4 suffer...

HT Mega – Absolute Addons For Elementor < 2.4.7 - Contributor+ Directory Traversal

Description The HT Mega – Absolute Addons For Elementor plugin is vulnerable to Directory Traversal via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to read the contents of arbitrary files on the server, which can contain sensitive...

WordPress HT Easy GA4 ( Google Analytics 4 ) Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software HT Easy GA4 Google Analytics 4 Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29094 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8f8e72c6e71d Credits Yudistira Arya...

WordPress HT Mega Plugin <= 2.4.6 is vulnerable to Directory Traversal

Software HT Mega Type Plugin Vulnerable versions = 2.4.6 Fixed in 2.4.7 OWASP Top 10 A5: Broken Access Control Classification Directory Traversal CVE CVE-2024-1974 Patch priority Low CVSS severity Low 7.7 Developer HTMega PSID 6d7e2f2731f2 Credits Webbernaut Required privilege Contributor Publish...

CVE-2024-1176

CVE-2024-1176 affects the HT Easy GA4 – Google Analytics WordPress Plugin. The vulnerability is a missing capability check in login() that enables unauthenticated modification of the GA4 email. Affected versions are all up to and including 1.1.5. Remediation: upgrade to 1.1.6 or later (Wordfence/...

CVE-2024-1176 HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update

The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the login function in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to update the email...

HT Mega – Absolute Addons For Elementor < 2.4.5 - Contributor+ Stored Cross-Site Scripting via Post Carousel Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the ‘bordertype’ attribute of the Post Carousel widget in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-1421

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bordertype’ attribute of the Post Carousel widget in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2024-1397

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on the 'titleTag' user supplied attributes. This makes it...

CVE-2024-1397

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on the 'titleTag' user supplied attributes. This makes it...

CVE-2024-1421

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bordertype’ attribute of the Post Carousel widget in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible f...

Cross site scripting

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bordertype’ attribute of the Post Carousel widget in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible f...