CVE-2024-8728 Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting

The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-8728

CVE-2024-8728 affects the WordPress plugin Easy Load More (versions ≤ 1.0.3). It enables Reflected Cross-Site Scripting due to insufficient escaping of add_query_arg, allowing unauthenticated attackers to inject scripts when a user is tricked into clicking a link. The provided documents do not sp...

CVE-2024-8728 Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting

The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

WordPress Easy Load More plugin <= 1.0.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Easy Load More versions = 1.0.3...

WordPress plugin Easy Load More 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

CVE-2024-8728: Improper Neutralization of Input During Web Page Generation

The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

WordPress Easy Load More Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Easy Load More Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8728 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 59f09f12d886 Credits vgo0 Required privile...

PT-2024-39207 · WordPress · Easy Load More

Name of the Vulnerable Software and Affected Versions: Easy Load More plugin for WordPress versions up to, and including, 1.0.3 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts in...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-7006-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7006-1 advisory. It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A...

CVE-2024-8292: Authorization Bypass Through User-Controlled Key

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

PT-2024-6634 · WordPress · Wordpress Infinite Scroll – Ajax Load More

Name of the Vulnerable Software and Affected Versions: WordPress Infinite Scroll – Ajax Load More plugin versions up to, and including, 7.1.2 Description: The issue is related to insufficient input sanitization and output escaping, allowing for Stored Cross-Site Scripting attacks. This can be...

AZL-48594 CVE-2024-44946 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcmsendmsg for the same socket. syzkaller reported UAF in kcmrelease. 0 The scenario is 1. Thread A builds a skb with MSGMORE and sets kcm-seqskb. 2. Thread A resumes building skb from kcm-seqskb but is blocked by...

CVE-2024-8200: Cross-Site Request Forgery (CSRF)

The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'updateapikey'...

CVE-2024-43259: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue affects Order Export for WooCommerce: from n/a through = 3.23...

USN-6951-4: Linux kernel (BlueField) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - M68K architecture; - User-Mode Linux UML; - x86 architecture; - Accessibility subsystem; -...

USN-6951-3: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - M68K architecture; - User-Mode Linux UML; - x86 architecture; - Accessibility subsystem; -...

PT-2024-38071 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress versions up to, and including, 5.9.27 Description: The issue is related to Stored Cross-Site Scripting via the no more...

kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption

A kernel stack flaw that corrupted the Linux kernel’s Mellanox Technologies Spectrum Ethernet driver was found when a user initialized more than 16 access control lists ACLs. This flaw allows a local user to crash or potentially escalate their privileges on the system...

PT-2024-17137 · Automationdirect · C-More Ea9 Eap9

Name of the Vulnerable Software and Affected Versions: AutomationDirect C-More EA9 EAP9 affected versions not specified Description: The issue is a remote code execution vulnerability due to memory corruption in the analysis of AutomationDirect C-More EA9 EAP9 files. This allows remote attackers ...

USN-6895-3: Linux kernel vulnerabilities

It was discovered that the ATA over Ethernet AoE driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2023-6270 It was discovered that the HugeTLB file syst...