CVE-2024-10793 WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the userid parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-10793 WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the userid parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-10793

CVE-2024-10793 affects the WP Activity Log WordPress plugin (versions

CVE-2024-9356

The CVE CVE-2024-9356 affects the Yotpo: Product & Photo Reviews for WooCommerce WordPress plugin. It enables Reflected Cross-Site Scripting via the yotpo_user_email and yotpo_user_name parameters in all versions up to and including 1.7.8 due to insufficient input sanitization and output escaping...

CVE-2024-9356 Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.8 - Reflected Cross-Site Scripting

The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpouseremail' and 'yotpousername' parameters in all versions up to, and including, 1.7.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-10113

The vulnerability CVE-2024-10113 affects the WordPress plugin WP AdCenter – Ad Manager & Adsense Ads, specifically via the wpadcenter_ad shortcode. The issue is a Stored Cross-Site Scripting (XSS) in all versions up to and including 2.5.7 caused by insufficient input sanitization and output escap...

CVE-2024-10113 WP AdCenter – Ad Manager & Adsense Ads <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode

The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenterad shortcode in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-9609 LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpressimportformserver' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2024-9609

CVE-2024-9609 affects LearnPress Export Import – WordPress extension for LearnPress (WordPress) up to version 4.0.4. The vulnerability is a reflected cross-site scripting flaw caused by insufficient input sanitization and output escaping in the learnpress_import_form_server parameter, enabling un...

CVE-2024-9609 LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpressimportformserver' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes ...

PT-2024-16574 · WordPress · Hide My Wp Ghost

Name of the Vulnerable Software and Affected Versions: Hide My WP Ghost – Security & Firewall plugin for WordPress versions up to, and including, 5.3.01 Description: The issue is related to Reflected Cross-Site Scripting via the URL due to insufficient input sanitization and output escaping. This...

CVE-2024-8180 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled...

CVE-2024-10146

The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins...

GitLab 17.3 < 17.3.7 / 17.4 < 17.4.4 / 17.5 < 17.5.2 (CVE-2024-8180)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enable...

The vulnerability of the SCSI component in the Linux operating system allows a hacker to gain access to confidential information.

The vulnerability of the Linux operating system’s SCSI kernel component is related to excessive data output in the scsihostdevrelease function. Exploiting this vulnerability can allow an attacker to gain access to confidential information...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 跨站脚本漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A cross-site scripting vulnerability exists in GitLab Enterprise Edition EE and GitLab...

IBM Security ReaQta 跨站脚本漏洞

ReaQta is an advanced endpoint security platform from IBM Security that utilizes artificial intelligence and machine learning technologies to identify, manage and automate responses to cybersecurity threats. A cross-site scripting vulnerability exists in Security ReaQta that stems from the...

CVE-2024-9668

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2024-9059

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-9059

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...