WordPress WP Meetup plugin <= 2.3.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika in WordPress Plugin WP Meetup versions = 2.3.0...

CVE-2024-57011

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg...

CVE-2024-13104 D-Link DIR-816 A2 WiFi Settings form2AdvanceSetup.cgi access control

A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05R1B011D88210. Affected is an unknown function of the file /goform/form2AdvanceSetup.cgi of the component WiFi Settings Handler. The manipulation leads to improper access controls. It is possible to launch t...

WordPress Cost Calculator Builder plugin < 3.2.43 - Settings update via CSRF vulnerability

Settings update via CSRF vulnerability discovered by Miguel Xavier Penha Neto in WordPress Plugin Cost Calculator Builder versions 3.2.43...

WordPress Advance Menu Manager plugin <= 3.1.1 - Settings Change vulnerability

Settings Change vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Advance Menu Manager versions = 3.1.1...

WordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WPCargo Track & Trace versions = 8.0.2...

PT-2024-39907 · 10Web · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to, and including, 1.8.30 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization a...

baserCMS 跨站脚本漏洞

baserCMS is an Enterprise Content Management System CMS from the baserCMS team. A cross-site scripting vulnerability exists in baserCMS versions prior to 5.1.2, which stems from a cross-site scripting vulnerability in the Edit Email Form Settings feature...

WordPress Linkz.ai plugin <= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update vulnerability

Missing Authorization to Unauthenticated Plugin Settings Update vulnerability discovered by István Márton in WordPress Plugin Linkz.ai versions = 1.1.8...

School Dormitory Management System 1.0 Insecure Settings

==================================================================================================================================== | Title : School Dormitory Management System v1.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefo...

PT-2024-38770 · Infolinks · Infolinks Ad Wrap Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: infolinks Ad Wrap WordPress plugin versions 1.0.0 through 1.0.2 Description: The issue is related to the lack of CSRF protection when updating settings in the infolinks Ad Wrap WordPress plugin. This could allow attackers to make a logged-in...

Medical Card Generations System 1.0 Insecure Settings

==================================================================================================================================== | Title : Medical Card Generations System 1.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

CVE-2023-4027

The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatesettings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings...

D-Link DAP-1325 StaticDefaultGateway Stack Buffer Overflow Vulnerability

D-Link DAP-1325 is a wireless access point/bridge made by D-Link, which is mainly used to extend the wireless network coverage, support the conversion of wired network to wireless network or connect different wireless networks. The D-Link DAP-1325 suffers from a stack buffer overflow vulnerabilit...

BIT-WORDPRESS-MULTISITE-2024-3755

The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5002 User Submitted Posts < 20240516 - Admin+ Stored XSS

The User Submitted Posts WordPress plugin before 20240516 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-4752 EventON < 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitle

The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Swift Framework plugin < 2024.04.30 - Admin+ Stored XSS via Settings vulnerability

Admin+ Stored XSS via Settings vulnerability discovered by Bob Matyas in WordPress Plugin Swift Framework Page Builder versions 2024.04.30...

Simple Online Bidding System Code Issue Vulnerability

Simple Online Bidding System is an online bidding system by oretnom23 individual developers. A code issue vulnerability exists in SourceCodester Simple Online Bidding System version 1.0, which stems from the parameter img in the file /admin/ajax.php?action=savesettings that can lead to unrestrict...

WordPress plugin Pray For Me security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...