CVE-2022-1226 Cross-site Scripting (XSS) in phpipam/phpipam

A Cross-Site Scripting XSS vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include...

CVE-2024-9529

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privile...

CVE-2024-10582

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importmpfetemplate function in all versions up to, and including, 2.4.1. This makes it possible for authenticated...

CVE-2024-10582

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importmpfetemplate function in all versions up to, and including, 2.4.1. This makes it possible for authenticated...

CVE-2024-10582 Music Player for Elementor – Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importmpfetemplate function in all versions up to, and including, 2.4.1. This makes it possible for authenticated...

CVE-2024-10582

CVE-2024-10582 affects the WordPress plugin Music Player for Elementor – Audio Player & Podcast Player, versions up to and including 2.4.1. A missing capability check in import_mpfe_template() allows authenticated users with Subscriber-level access and above to import templates, enabling unauthor...

CVE-2024-9609

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpressimportformserver' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-9609 LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpressimportformserver' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-9609

CVE-2024-9609 affects LearnPress Export Import – WordPress extension for LearnPress (WordPress) up to version 4.0.4. The vulnerability is a reflected cross-site scripting flaw caused by insufficient input sanitization and output escaping in the learnpress_import_form_server parameter, enabling un...

CVE-2024-9609 LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpressimportformserver' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes ...

WordPress plugin LearnPress Export Import 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

WordPress plugin Secure Custom Fields 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in th...

PT-2024-16381 · WordPress · The Music Player For Elementor – Audio Player & Podcast Player

Name of the Vulnerable Software and Affected Versions: The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress versions up to, and including, 2.4.1 Description: The issue is related to unauthorized modification of data due to a missing capability check on the import mp...

WordPress Music Player for Elementor plugin <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import vulnerability

Missing Authorization to Authenticated Subscriber+ Template Import vulnerability discovered by WordFence in WordPress Plugin Music Player for Elementor – Audio Player & Podcast Player versions = 2.4.1...

WordPress LearnPress Export Import plugin <= 4.0.4 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin LearnPress Export Import versions = 4.0.4...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-768)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-768 advisory. A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model...

WordPress LearnPress Export Import Plugin <= 4.0.4 is vulnerable to Cross Site Scripting (XSS)

Software LearnPress Export Import Type Plugin Vulnerable versions = 4.0.4 Fixed in 4.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9609 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 496adf4dad4b Credits vgo0...

PT-2024-39715 · WordPress · Learnpress Export Import

Name of the Vulnerable Software and Affected Versions: LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress versions up to, and including, 4.0.4 Description: The issue is related to Reflected Cross-Site Scripting via the learnpress import form server parameter due to...

CVE-2024-10854

The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...

PT-2024-16387 · WordPress · Leopard - Wordpress Offload Media

Name of the Vulnerable Software and Affected Versions: Leopard - WordPress Offload Media plugin versions up to, and including, 3.1.1 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the import settings function...