WordPress Ajax Load More plugin <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via buttonlabel Parameter vulnerability discovered by Robert DeVore in WordPress Plugin Ajax Load More versions = 7.1.2...

CVE-2024-8505: Improper Neutralization of Alternate XSS Syntax

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttonlabel’ parameter in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Ajax Load More Plugin <= 7.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Load More Type Plugin Vulnerable versions = 7.1.2 Fixed in 7.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8505 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 333f5ab48634 Credits Robert DeVore Required...

CVE-2024-8728 Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting

The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-8728 Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting

The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-8728

CVE-2024-8728 affects the WordPress plugin Easy Load More (versions ≤ 1.0.3). It enables Reflected Cross-Site Scripting due to insufficient escaping of add_query_arg, allowing unauthenticated attackers to inject scripts when a user is tricked into clicking a link. The provided documents do not sp...

WordPress Easy Load More plugin <= 1.0.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Easy Load More versions = 1.0.3...

PT-2024-39207 · WordPress · Easy Load More

Name of the Vulnerable Software and Affected Versions: Easy Load More plugin for WordPress versions up to, and including, 1.0.3 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts in...

WordPress plugin Easy Load More 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress Easy Load More Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Easy Load More Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8728 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 59f09f12d886 Credits vgo0 Required privile...

CVE-2024-8728: Improper Neutralization of Input During Web Page Generation

The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-7006-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7006-1 advisory. It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A...

CVE-2024-8292: Authorization Bypass Through User-Controlled Key

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

PT-2024-6634 · WordPress · Wordpress Infinite Scroll – Ajax Load More

Name of the Vulnerable Software and Affected Versions: WordPress Infinite Scroll – Ajax Load More plugin versions up to, and including, 7.1.2 Description: The issue is related to insufficient input sanitization and output escaping, allowing for Stored Cross-Site Scripting attacks. This can be...

AZL-48594 CVE-2024-44946 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcmsendmsg for the same socket. syzkaller reported UAF in kcmrelease. 0 The scenario is 1. Thread A builds a skb with MSGMORE and sets kcm-seqskb. 2. Thread A resumes building skb from kcm-seqskb but is blocked by...

CVE-2024-8200: Cross-Site Request Forgery (CSRF)

The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'updateapikey'...

CVE-2024-43259: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue affects Order Export for WooCommerce: from n/a through = 3.23...

USN-6951-4: Linux kernel (BlueField) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - M68K architecture; - User-Mode Linux UML; - x86 architecture; - Accessibility subsystem; -...

USN-6951-3: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - M68K architecture; - User-Mode Linux UML; - x86 architecture; - Accessibility subsystem; -...

PT-2024-38071 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress versions up to, and including, 5.9.27 Description: The issue is related to Stored Cross-Site Scripting via the no more...