CVE-2021-24289

Store Locator Plus for WordPress (

CVE-2021-24289 Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the Store...

WordPress plugin 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A security vulnerability exists in the Store Locator Plus...

Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL

When a user clicked on an FTP URL containing encoded newline characters %0A and %0D, the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)

There are several endpoints in the plugin that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages. PoC The PoC will be displayed once the issue has been remediated...

Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)

There are several endpoints in the plugin that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages. The PoC will be displayed once the issue has been remediated...

WordPress Store Locator Plus plugin <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordPress Store Locator Plus plugin versions = 5.5.15. Solution Update the WordPress Store Locator Plus plugin to the latest available version at least 5.7...

Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

There is functionality in the plugin that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin. Partially unpatched because they added CSRF protection that technically blocks low-level users from using the endpoint, howeve...

Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

There is functionality in the plugin that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin. Partially unpatched because they added CSRF protection that technically blocks low-level users from using the endpoint, howeve...

WordPress Store Locator Plus plugin <= 5.5.14 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by WordFence in WordPress Store Locator Plus plugin versions = 5.5.14. Solution Update the WordPress Store Locator Plus plugin to the latest available version at least 5.5.15...

Cross site scripting

remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: LocatorURL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go...

IBM Security Identity Governance and Intelligence 输入验证错误漏洞

IBM Security Identity Governance and Intelligence is an integrated identity management solution based on network devices. A denial of service vulnerability exists in IBM Security Identity Governance and Intelligence 5.2.6. The vulnerability arises from improper authentication of a supplied URL. A...

PHP Input Validation Error Vulnerability

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language jointly maintained by the PHP community. The language is primarily used for web development and supports a variety of databases and operating systems. PHP suffers from an input validation error...

Super Store Finder 3.3 Cross Site Scripting

Exploit type : XSS INJECTION Exploit title : Super Store Finder Add location XSS Injection Descriptions : XSS injection from adding store and reflected XSS in SQL error login page PHP Script affected : Super Store Finder | Mega Locator Plugin URI : http://www.superstorefinder.net/ Version : 3.3 a...

zeiss.med.locator.cloud Cross Site Scripting vulnerability OBB-1278823

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Mozilla: Information disclosure due to manipulated URL object

The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...

Mozilla: Information disclosure due to manipulated URL object

The Mozilla Foundation Security Advisory describes this flaw as: Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript...

Unspecified Vulnerability in Apple macOS Catalina NSURL Component

Apple macOS Catalina is a proprietary operating system developed by Apple for Mac computers, and NSURL is one of the components used to handle URLs Uniform Resource Locators. A security vulnerability exists in the NSURL component in Apple macOS Catalina versions prior to 10.15.5. An attacker coul...

The vulnerability of Google Chrome, related to insufficient filtering in the URL string, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of Google Chrome is related to insufficient filtering in the URL string. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...