WordPress Automatically Hierarchic Categories in Menu plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin Automatically Hierarchic Categories in Menu versions = 2.0.5...

September 30, 2024—KB5043178 (OS Build 26100.1882) Preview

None None...

WordPress Automatically Hierarchic Categories in Menu Plugin <= 2.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Automatically Hierarchic Categories in Menu Type Plugin Vulnerable versions = 2.0.5 Fixed in 2.0.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47365 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f5046a3cf120 Credits theviper17...

WordPress plugin WP MultiTasking – WP Utilities 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-38864 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking – WP Utilities plugin for WordPress versions up to, and including, 0.1.17 Description: The issue is related to Stored Cross-Site Scripting via the wpmt menu name parameter due to insufficient input sanitization and output...

September 26, 2024—KB5043145 (OS Builds 22621.4249 and 22631.4249) Preview

None None...

CVE-2024-8434

The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2024-8434

The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2024-8434

CVE-2024-8434 affects the Easy Mega Menu Plugin for WordPress – ThemeHunk. A missing capability check on several AJAX-hooked functions allows authenticated users with subscriber-level access and above to perform actions such as updating plugin settings in all versions up to 1.0.9. The vulnerabili...

CVE-2024-45066: Improper Neutralization of Special Elements used in a Command

A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands...

CVE-2024-43693: Improper Neutralization of Special Elements used in a Command

A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands...

CVE-2024-8434: Missing Authorization

The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2023-26690

File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu...

September 24, 2024—KB5043131 (OS Build 19045.4957) Preview

None None...

PT-2024-39011 · Themehunk · Easy Mega Menu Plugin

Name of the Vulnerable Software and Affected Versions: Easy Mega Menu Plugin for WordPress – ThemeHunk plugin versions up to, and including, 1.0.9 Description: The issue arises from a missing capability check on several functions hooked via AJAX, allowing authenticated attackers with...

htmly 2.9.9 Cross Site Scripting

Exploit Title: Stored XSS in "Edit Profile" - htmlyv2.9.9 Date: 9/2024 Exploit Author: Andrey Stoykov Version: 2.9.9 Tested on: Ubuntu 22.04 Blog: https://msecureltd.blogspot.com/2024/09/friday-fun-pentest-series-11-stored-xss.html Stored XSS 1: Steps to Reproduce: 1. Login as author 2. Browse to...

[20250102] - Core - XSS vector in the id attribute of menu lists

Lack of output escaping in the id attribute of menu lists...

WordPress Accordion Image Menu plugin <= 3.1.3 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Accordion Image Menu versions = 3.1.3...

CVE-2024-8092

The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8092

The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...