WordPress School Management Pro Plugin <= 10.3.4 is vulnerable to SQL Injection

Software School Management Pro Type Plugin Vulnerable versions = 10.3.4 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-33911 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 78a8a05cb12b Credits Ivan Spiridonov Required privilege School...

Booking Ultra Pro < 1.1.13 - Authenticated (Contributor+) Privilege Escalation

Description The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.12. This makes it possible for authenticated attackers, with contributor-level access and above, to escalate their privileges...

PT-2024-25391 · Piotnet · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor Pro versions through 7.1.17 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attacke...

PT-2024-25393 · Piotnet · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor Pro versions through 7.1.17 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations: For...

CVE-2024-3962 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

CVE-2024-3962 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

CVE-2024-3962

The CVE CVE-2024-3962 affects Product Addons & Fields for WooCommerce (PPOM) on WordPress. It is caused by missing file type validation in the ppom_upload_file function, allowing unauthenticated arbitrary file uploads on all versions up to and including 32.0.18. Exploitation requires PPOM Pro ins...

EUVD-2024-32528

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files...

WordPress Header Footer Code Manager Pro plugin <= 1.0.16 - Reflected Cross-Site Scripting via message vulnerability

Reflected Cross-Site Scripting via message vulnerability discovered by 1337Wannabe in WordPress Plugin Header Footer Code Manager Pro versions = 1.0.16...

WordPress ElementsKit Pro plugin <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets vulnerability

Authenticated Contributor+ Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets vulnerability discovered by Webbernaut in WordPress Plugin ElementsKit Pro versions = 3.6.0...

WordPress WP STAGING Pro plugin <= 5.4.3 - Sensitive Information Exposure via Log File vulnerability

Sensitive Information Exposure via Log File vulnerability discovered by haidv35 in WordPress Plugin Wp Staging Pro versions = 5.4.3...

PT-2024-28556 · WordPress · Product Addons & Fields For Woocommerce +1

Name of the Vulnerable Software and Affected Versions: Product Addons & Fields for WooCommerce plugin for WordPress versions up to, and including, 32.0.18 Description: The issue is related to missing file type validation in the ppom upload file function, allowing unauthenticated attackers to uplo...

WordPress Header Footer Code Manager Pro Plugin <= 1.0.16 is vulnerable to Cross Site Scripting (XSS)

Software Header Footer Code Manager Pro Type Plugin Vulnerable versions = 1.0.16 Fixed in 1.0.17 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3473 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7f73969b36b2 Credits...

WordPress Wp Staging Pro Plugin <= 5.4.3 is vulnerable to Sensitive Data Exposure

Software Wp Staging Pro Type Plugin Vulnerable versions = 5.4.3 Fixed in 5.5.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-3682 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID eb5b93b83c9e Credits haidv35 Required privilege...

WordPress ElementsKit Pro Plugin <= 3.6.0 is vulnerable to Local File Inclusion

Software ElementsKit Pro Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.6.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3500 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 23f884009c74 Credits Webbernaut Required privilege Contributor...

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Arbitrary Post/Page Deletion vulnerability

Unauthenticated Arbitrary Post/Page Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.17...

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.17...

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.17...

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.17...

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Authenticated Stored Cross Site Scripting (XSS) vulnerability

Authenticated Stored Cross Site Scripting XSS vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.17...