231585 matches found
CVE-2023-6036
CVE-2023-6036 affects the Web3 WordPress plugin before 3.0.0. The root cause is incorrect authentication checking in the login flow, specifically in the functions "handle_auth_request" and "handle_login_request" (note: some sources spell the second as 'hadle_login_request'). This enables an unaut...
CVE-2023-6082
CVE-2023-6082 affects the chartjs WordPress plugin (through version 2023.2). The root cause is inadequate sanitization/escapes of certain plugin settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite). Connected sources s...
CVE-2023-6591
CVE-2023-6591 affects the Popup Box WordPress plugin (before 20.9.0). The issue is due to inadequate sanitization/escaping of settings, enabling stored XSS that could be executed by high-privilege users (e.g., admins) even when unfiltered_html is disallowed. Connected sources describe admin+ stor...
CVE-2023-6499
CVE-2023-6499 affects the LasTunes WordPress plugin (
CVE-2024-0248
The CVE-2024-0248 entry concerns the EazyDocs WordPress plugin prior to 2.4.0, where insufficient access controls allowed authenticated users (e.g., subscribers) to delete arbitrary posts and to add/delete documents/sections. Root cause is broken access control, with where unauthenticated access ...
CVE-2024-0420
MapPress Maps for WordPress Plugin prior to 2.88.15 is affected by a Stored XSS vulnerability: the map title is not sanitized/escaped when output in the admin dashboard, allowing Contributors and higher roles to inject exploits. Impact details reported across multiple sources (including Red Hat, ...
CVE-2024-0250
The CVE-2024-0250 entry concerns the Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin, prior to version 6.3. The issue is an Open Redirect caused by insufficient validation on the redirect file oauth2callback.php, enabling unauthenticated attackers to steer users to potentially m...
CVE-2023-7233
CVE-2023-7233 affects the GigPress WordPress plugin up to version 2.3.29. Affected component: plugin settings not sanitised/escaped, enabling Stored Cross-Site Scripting by high-privilege users (e.g., Administrators) even when unfiltered_html is disallowed (multisite scenarios). Documented detail...
CVE-2024-0421
The CVE-2024-0421 entry concerns the WordPress MapPress Maps plugin prior to 2.88.16, where an IDOR allows unauthenticated users to read private and draft posts via an AJAX action that should only expose public maps. Multiple connected sources confirm the flaw and its public-facing impact, includ...
Open redirect
Rejected reason: REJECT This is a duplicate of CVE-2024-1049. Please use CVE-2024-1049 instead...
CVE-2023-6681
CVE-2023-6681 affects JWCrypto in python-jwcrypto. Root cause: unbounded PBES2 Count value in PBKDF2 enables a DoS when processing crafted JWE tokens; high resource consumption is possible. Documented impact: denial of service (and potential password brute‑force/dictionary pressure). Remediation/...
CVE-2024-1062
CVE-2024-1062 is a heap overflow in 389-ds-base that can cause a denial of service when a value larger than 256 characters is written to the log_entry_attr field. The CVE is evaluated as a local, high-availability risk with a MEDIUM base score from CVSS 3.1 (AV:L, AC:L, PR:L, UI:N, S:U, C:N, I:N,...
Design/Logic Flaw
Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent...
CVE-2024-1439
CVE-2024-1439: In Moodle LMS, an inadequate access-control flaw allows a local student to create arbitrary events for higher-role users and add events to all users’ calendars. OpenVAS references Moodle
Cross site request forgery (csrf)
Processing of user-defined mail search expressions is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of mail search expressions now gets monitored, and the related request is terminated...
Cross site request forgery (csrf)
Processing of user-defined DAV user-agent strings is not limited. Availability of OX App Suite could be reduced due to high processing load. Please deploy the provided updates and patch releases. Processing time of DAV user-agents now gets monitored, and the related request is terminated if a...
Deserialization of untrusted data
Deserialization of Untrusted Data vulnerability in wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks.This issue affects ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks: from n/a through 3.1.4...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Ryan Duff, Peter Westwood WP Contact Form.This issue affects WP Contact Form: from n/a through 1.6...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Contest Gallery Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress.This issue affects Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress...