CVE-2024-4789

CVE-2024-4789 : Cost Calculator Builder Pro for WordPress vulnerable to Server-Side Request Forgery (SSRF) via send_demo_webhook() in all versions up to 3.1.72. Exploitation requires authenticated access at subscriber level or higher, enabling the attacker to make outbound requests from the web a...

CVE-2024-4789 Cost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery

Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the senddemowebhook function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations...

GHSA-MXHQ-XW3G-RPHC lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Summary The latest version of lobe-chatby now v0.141.2 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. Details visit https://chat-preview.lobehub.com/settings/agent you...

CVE-2024-1467

The CVE-2024-1467 vulnerability affects the Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress. It is a Server-Side Request Forgery (SSRF) vulnerability exploitable by authenticated attackers with contributor-level access and above via the ai_api_request() fu...

CVE-2024-3047

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-3047

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-3047

Technical details (affected product/version, root cause, impact, remediation) are not provided in the Connected documents. Monitor for updates from vendors or official advisories to obtain concrete details and mitigation.

CVE-2024-3047 PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...

WordPress plugin PDF Invoices & Packing Slips for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. A security vulnerability exists i...

Piotnet Addons For Elementor Pro <= 7.1.17 - Unauthenticated Server-Side Request Forgery

Description The Piotnet Addons For Elementor Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.17. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application...

CVE-2024-2663

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-2663 ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-2663 ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery

The ZD YouTube FLV Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.6 via the $GET'image' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-0216

The CVE-2024-0216 entry for Google Doc Embedder (WordPress) is a SSRF vulnerability in the gview shortcode present in WordPress plugin versions up to 2.6.4. Reported impact states that authenticated users with contributor permissions can cause the application to make outbound requests to arbitrar...

PT-2024-21432 · WordPress · Zd Youtube Flv Player

Name of the Vulnerable Software and Affected Versions: ZD YouTube FLV Player plugin for WordPress versions up to, and including, 1.2.6 Description: The issue allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to que...

Really Simple SSL < 8.0.0 - Admin+ Server-Side Request Forgery

Description The Really Simple SSL plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.2.3. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating...

PDF Invoices & Packing Slips for WooCommerce < 3.8.1 - Unauthenticated Server-Side Request Forgery

Description The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from...

CVE-2023-6805

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticated attackers,...

PT-2024-24092 · Plane · Plane

Name of the Vulnerable Software and Affected Versions: Plane versions prior to 0.17-dev Description: The issue is a Server-Side Request Forgery SSRF vulnerability that may allow an attacker to send arbitrary requests from the server hosting the application, potentially leading to unauthorized...

Kadence Blocks < 3.2.12 - Contributor+ Server-Side Request Forgery

Description The plugin is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.26 via the 'kadenceimportgetnewconnectiondata' AJAX action. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary...