5929 matches found
CVE-2024-12258
CVE-2024-12258 — The WordPress plugin WP Service Payment Form With Authorize.net is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to 2.6.3 due to insufficient input sanitization and output escaping. The issue permits unauthenticated attackers to inject mal...
PT-2024-17512 · WordPress · Wp Service Payment Form With Authorize.Net
Name of the Vulnerable Software and Affected Versions: WP Service Payment Form With Authorize.net plugin for WordPress versions prior to 2.6.3 Description: The issue is related to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scrip...
WordPress plugin WP Service Payment Form With Authorize.net 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
How Cryptocurrency Turns to Cash in Russian Banks
A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this...
WordPress Invoice Payment for WooCommerce plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Invoice Payment for WooCommerce versions = 1.7.2...
WordPress Simple Payment plugin <= 2.3.8 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Simple Payment versions = 2.3.8...
CVE-2024-11205 WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...
WordPress WPForms plugin 1.8.4-1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation vulnerability
Missing Authorization to Authenticated Subscriber+ Payment Refund and Subscription Cancellation vulnerability discovered by villu164 in WordPress Plugin Contact Form by WPForms versions 1.8.4-1.9.2.1...
6,000,000 WordPress Sites Protected Against Payment Refund and Subscription Cancellation Vulnerability in WPForms WordPress Plugin
💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with ourEnd of Year Holiday Extravaganza , High-Risk Bonus Blitz Challenge , and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025: All in-scope vulnerability types for...
Altair 信任管理问题漏洞
Altair is a beautiful and feature-rich GraphQL client IDE from the Altair GraphQL open source. A trust management issue vulnerability exists in Altair versions prior to 8.0.5, which stems from improper HTTPS certificate validation and allows a man-in-the-middle attacker to intercept all requests,...
Malicious code in @iherb-payment/pages (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-11329
The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject...
CVE-2024-11329 Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting
The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject...
CVE-2024-11329
CVE-2024-11329 affects the WordPress plugin Comfino Payment Gateway up to version 4.1.1. It is a Reflected Cross-Site Scripting vulnerability caused by using add_query_arg and remove_query_arg without proper URL escaping, allowing unauthenticated attackers to inject scripts in pages triggered by ...
CVE-2024-11329 Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting
The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject...
PT-2024-16913 · WordPress · Comfino Payment Gateway
Name of the Vulnerable Software and Affected Versions: Comfino Payment Gateway plugin for WordPress versions up to, and including, 4.1.1 Description: The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg and remove query a...
WordPress Comfino Payment Gateway plugin <= 4.1.1 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Comfino Payment Gateway versions = 4.1.1...
CVE-2024-11729
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to SQL Injection via the 'servicelist0serviceid' parameter of the getwidgetpaymentoptions AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter an...
PT-2024-35751 · Wegia · Wegia
Name of the Vulnerable Software and Affected Versions: WeGIA version 3.2.0 Description: The issue concerns multiple stored cross-site scripting XSS vulnerabilities in the /configuracao/meio pagamento.php component. Attackers can execute arbitrary web scripts or HTML via a crafted payload injected...
