CVE-2024-5324

CVE-2024-5324 登录/注册弹窗（内联表单 + Woocommerce）2.7.1 - 2.7.2 - 缺少授权导致任意选项更新 描述： WordPress 的 Login/Signup Popup Inline Form + Woocommerce 插件在 2.7.1 至 2.7.2 版本中，由于 'importsettings' 函数缺少权限检查，容易受到未经授权的数据修改。这使得经过身份验证的攻击者（具有订阅者级别及更高级别的访问权限）能够更改受影响站点上的任意选项。这可用于启用新用户注册，并将新用户的默认角色设置为管理员。 root@kitploit: Severity...

CVE-2025-11993: Deserialization of Untrusted Data

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'importsettings' function. This is due to deserialization of untrusted data supplied via the import...

WordPress plugin Leopard 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Cross site scripting

Multiple Stored Cross-site scripting XSS vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users with minimal permissions to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mecsavenotifications and...