379 matches found
CVE-2024-10637
The CVE concerns the Gutenberg Blocks with AI by Kadence WP WordPress plugin (before 3.2.54). It states that some block options are not properly validated/escaped before being output in the page/post where the block is embedded, enabling Stored Cross-Site Scripting. Affected surface: authenticate...
CVE-2024-10480
The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
PT-2024-35857 · WordPress · Wp Mermaid
Name of the Vulnerable Software and Affected Versions: WP Mermaid versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject malicious scripts into the...
PT-2024-16482
Name of the Vulnerable Software and Affected Versions YaDisk Files WordPress plugin versions 1.2.5 and earlier Description The issue arises from the plugin's failure to validate and escape some of its shortcode attributes before outputting them back in a page or post where the shortcode is...
PT-2024-15984 · WordPress · Wp Booking Calendar
Name of the Vulnerable Software and Affected Versions: WP Booking Calendar WordPress plugin versions prior to 10.6.3 Description: The issue concerns the WP Booking Calendar WordPress plugin, which does not properly sanitise and escape some of its Widgets settings. This could allow high-privilege...
PT-2024-28188 · Upqode · Upqode Plum: Spin Wheel & Email Pop-Up
Name of the Vulnerable Software and Affected Versions: Upqode Plum: Spin Wheel & Email Pop-up versions n/a through 2.0 Description: The issue affects the Upqode Plum: Spin Wheel & Email Pop-up plugin, allowing access to functionality not properly constrained by ACLs, and stored XSS...
Multiple vulnerabilities in WordPress plugin "Welcart e-Commerce"
Overview WordPress plugin "Welcart e-Commerce" provided by Welcart Inc. contains multiple vulnerabilities listed below. SQL injection CWE-89 - CVE-2024-42404 Cross-site scripting CWE-79 - CVE-2024-45366 Shogo Kumamaru of LAC CyberLink Co., Ltd. reported this vulnerability to IPA. JPCERT/CC...
RHSA-2018:3618 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2018:0520 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2016:1079 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2015:1086 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2015:0697 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2014:1852 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2014:1051 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2014:0860 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2014:1648 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2013:1818 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...
RHSA-2012:0144 Red Hat Security Advisory: flash-plugin security update
Bulletin has no description...