447 matches found
CVE-2024-13680
Summary: CVE-2024-13680 affects the WordPress plugin Form Builder CP (shortcode CP_EASY_FORM_WILL_APPEAR_HERE) and describes an SQL Injection in the id parameter across versions up to 1.2.41 due to insufficient escaping and lack of query parameterization. Impact (as stated): Authenticated attacke...
CVE-2024-13234
The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2024-13234 Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injection
The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions up to, and including, 3.0.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...
CVE-2025-0308 Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied...
CVE-2025-0308 Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search parameter in all versions up to, and including, 2.9.1 due to insufficient escaping on the user supplied...
CVE-2024-45385
A vulnerability has been identified in Industrial Edge Management OS IEM-OS All versions. Affected components are vulnerable to reflected cross-site scripting XSS attacks. This could allow an attacker to extract sensitive information by tricking users into accessing a malicious link...
CVE-2024-45385
CVE-2024-45385 affects Industrial Edge Management OS (IEM-OS) across all versions via reflected cross-site scripting (XSS). The vulnerability arises in affected components that can leak sensitive information when a user is tricked into visiting a malicious link. Exploitation details are not provi...
CVE-2024-45385
A vulnerability has been identified in Industrial Edge Management OS IEM-OS All versions. Affected components are vulnerable to reflected cross-site scripting XSS attacks. This could allow an attacker to extract sensitive information by tricking users into accessing a malicious link...
CVE-2024-12067
The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'bookingitinerary' parameter of the 'wptravelgetbookingdata' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied...
CVE-2024-11939 Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘data’ parameter in all versions up to, and including, 3.2.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2024-12030
MDTF – Meta Data and Taxonomies Filter (WordPress) is vulnerable to SQL Injection via the key parameter in the mdf_value shortcode in all versions up to and including 1.3.3.5. The vulnerability requires authentication (Contributor level or higher) and can be leveraged to append additional SQL to ...
CVE-2024-12332
The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
CVE-2024-12416 Woomotiv <= 3.6.1 - Unauthenticated SQL Injection
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to SQL Injection via the 'woomotivseenproducts.' cookie in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2024-12416
CVE-2024-12416 affects the WordPress plugin “Live Sales Notification for Woocommerce – Woomotiv.” The vulnerability is an SQL Injection via the cookie parameter woomotiv_seen_products_.*, affecting all versions up to 3.6.1. Root cause: insufficient escaping of user-supplied data and lack of prope...
CVE-2024-12428 WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection
The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'orderuserlogindir' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
CVE-2024-11726
CVE-2024-11726 affects the BookingPress (Appointment Booking Calendar Plugin and Scheduling Plugin) for WordPress. The flaw is an SQL Injection in the shortcodes context: the category parameter of the bookingpress_form shortcode is inadequately escaped, allowing an authenticated user with Contrib...
CVE-2024-10856
CVE-2024-10856 affects the Booking Calendar WpDevArt plugin for WordPress, up to version 3.2.19. The flaw is a time-based, blind SQL injection via the id parameter in the shortcode wpdevart_booking_calendar, conditioned on the theme option delete_prev_date being enabled. The issue arises from ins...
CVE-2024-11912
The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘orderid’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
