CVE-2024-9267 Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter

The Easy WordPress Subscribe – Optin Hound plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2024-9267 Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter

The Easy WordPress Subscribe – Optin Hound plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2024-9267

CVE-2024-9267 pertains to the Easy WordPress Subscribe – Optin Hound plugin for WordPress. The vulnerability is a Reflected Cross‑Site Scripting (XSS) flaw caused by insufficient escaping of URLs when using add_query_arg, affecting all versions up to and including 1.4.3. The risk: unauthenticated...

PT-2024-39525 · WordPress · Easy Wordpress Subscribe – Optin Hound

Name of the Vulnerable Software and Affected Versions: Easy WordPress Subscribe – Optin Hound plugin versions up to, and including, 1.4.3 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

CVE-2024-9267: Improper Neutralization of Input During Web Page Generation

The Easy WordPress Subscribe – Optin Hound plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitra...

WordPress plugin Easy WordPress Subscribe: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Aimeos frontend controller security vulnerability

Aimeos frontend controller is an Aimeos open source frontend controller. Aimeos frontend controller has a security vulnerability that stems from an insecure direct object reference that could allow an attacker to disable the subscribe and comment functionality for other clients. The following...

SUSE CVE-2019-1000021

slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin Persistent Storage of Private Data via PubSub options profile, used for the configuration of default access model that can result in all of the contacts of...

WordPress Subscribe Comments File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Subscribe Comments File Read Vulnerability', 'Description' = %q This module exploits an authenticated directory traversal vulnerability...

CVE-2024-43287

Cross-Site Request Forgery CSRF vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82...

CVE-2024-43287

Cross-Site Request Forgery CSRF vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82...

CVE-2024-43287

CVE-2024-43287 is a CSRF vulnerability in Brevo (Sendinblue) WordPress plugin forms (Newsletter, SMTP, Email marketing and Subscribe forms). The vulnerability affects Brevo forms up to version 3.1.82. The connected PT security entry recommends upgrading to 3.1.83 as the remediation. Other sources...

CVE-2024-43287: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82...

WordPress MailChimp Subscribe Form plugin <= 4.0.9.7 - Stored Cross-Site Scripting vulnerability

Stored Cross-Site Scripting vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin MailChimp Subscribe Forms versions = 4.0.9.7...

WordPress MailChimp Subscribe Forms Plugin <= 4.0.9.9 is vulnerable to Cross Site Scripting (XSS)

Software MailChimp Subscribe Forms Type Plugin Vulnerable versions = 4.0.9.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43211 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b6921b6bb1b6 Credits Steven Julian Required...

D-Link DAP-1650 EOL Device Multiple Command Injection Vulnerabilities (Jan 2024)

D-Link DAP-1650 devices are prone to multiple command injection vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Malware in trip-component-platform-online-subscribe-checkbox

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in trip-component-platform-online-subscribe-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1b75c5dae9b8499101bc5b5b006cc02b0d3da7be0669d9c7b9aa2f3191a34f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-21863

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor Exynos versions 980, 850, 1280, 1380, and 1330 Description An issue was discovered in the function slsi nan subscribe get nl params, where there is no input validation check on hal req-rx match filter len coming from...

PT-2024-21866

Name of the Vulnerable Software and Affected Versions Samsung Mobile Processor Exynos versions 980, 850, 1280, 1380, and 1330 Description An issue was discovered in the function slsi nan subscribe get nl params, where there is no input validation check on hal req-num intf addr present coming from...