PT-2024-25847 · Unknown · Wp Post Author

Name of the Vulnerable Software and Affected Versions: WP Post Author versions 3.6.4 and earlier Description: The issue is related to a Missing Authorization vulnerability in AF themes WP Post Author. Recommendations: For WP Post Author versions 3.6.4 and earlier, update to a version that contain...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via LaStudioKit Post Author Widget vulnerability discovered by Abu Hurayra in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.3.7.5...

CVE-2024-1840

The CVE-2024-1840 entry concerns WPBakery Visual Composer (js_composer) for WordPress. It describes a Stored Cross-Site Scripting vulnerability via the Post Author tag attribute in all versions up to and including 7.5. Exploitation requires authentication with Contributor+ privileges, enabling an...

CVE-2024-1840 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author

The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Author tag attribute in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or...

CVE-2024-3005

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget in all versions up to, and including, 1.3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

WordPress plugin LA-Studio Element Kit for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Plugin WPBakery Visual Composer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-23183 · WordPress · La-Studio Element Kit

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.3.7.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget due to insufficient input...

WordPress Virtue theme <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Post Author vulnerability discovered by stealthcopter in WordPress Theme Virtue versions = 3.4.8...

WordPress WPBakery Visual Composer plugin <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Post Author vulnerability discovered by Nikolas in WordPress Plugin WPBakery Page Builder versions = 7.5...

WordPress WP Post Author Plugin <= 3.2.3 is vulnerable to Privilege Escalation

Software WP Post Author Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.3.0 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE N/A Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 6affa2eefe9f Credits N/A Required privilege Unauthenticated...

CVE-2022-0478

The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the postauthorgutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection...

WordPress plugin WooCommerce SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. SQL injection vulnerability exists in versions of...

CVE-2017-6514

WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information Path Disclosure via a /wp-json/oembed/1.0/embed?url= request, related to the "authorname":" substring...

Fedora 20 : ikiwiki-3.20140125-1.fc20 (2014-1747)

Update to the latest stable version. Changes in ikiwiki 3.20140125 : - inline: Allow overriding the title of the feed. Closes: http://bugs.debian.org/735123 Thanks, Christophe Rhodes - osm: Escape name parameter. Closes: http://bugs.debian.org/731797 Changes in ikiwiki 3.20140102 : - aggregate:...