15315 matches found
CVE-2024-37483
CVE-2024-37483 describes a Missing Authorization vulnerability in the WordPress plugin The Post Grid by RadiusTheme. The issue affects The Post Grid versions up to and including 7.7.4 and involves exploitable access control misconfigurations that permit bypassing authorization checks due to Incor...
CVE-2024-37510
CVE-2024-37510 concerns WordPress plugin Charitable (Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress) with versions up to 1.8.1.7. The root cause is a missing authorization check that allows users to access functionality not constrained by ACLs. The vulnerabil...
CVE-2024-43212 WordPress WpTravelly plugin <= 1.7.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in MagePeople Team WpTravelly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through 1.7.7...
CVE-2024-43212
CVE-2024-43212 concerns the WordPress plugin WpTravelly (MagePeople Team) with a Missing Authorization vulnerability. The initial and connected documents consistently describe a Broken Access Control issue that allows accessing functionality not properly constrained by ACLs in WpTravelly versions...
CVE-2024-43925
CVE-2024-43925 describes a Missing Authorization vulnerability in the Envira Gallery WordPress plugins (Envira Gallery Lite / Envira Photo Gallery) affecting versions up to and including 1.8.14. The issue arises from incorrectly configured access control/security levels, enabling a bypass of auth...
PT-2024-27591 · Radiustheme · Post Grid Team
Name of the Vulnerable Software and Affected Versions: Post Grid Team by RadiusTheme versions n/a through 7.7.4 Description: The issue is related to a Missing Authorization vulnerability in the Post Grid Team by RadiusTheme. It allows exploiting incorrectly configured access control security...
PT-2024-27531 · Unknown · Team Emilia Projects Progress Planner
Name of the Vulnerable Software and Affected Versions: Team Emilia Projects Progress Planner versions 0.9.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions...
LottieFiles Issues Warning About Compromised "lottie-player" npm Package
LottieFiles has revealed that its npm package "lottie-player" was compromised as part of a supply chain attack, prompting it to release an updated version of the library. "On October 30th 6:20 PM UTC - LottieFiles were notified that our popular open source npm package for the web player...
CVE-2024-10223 HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode
The WP Team – WordPress Team Member Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's htteamember shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-10223 HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode
The WP Team – WordPress Team Member Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's htteamember shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-10223
CVE-2024-10223 affects the WP Team – WordPress Team Member Plugin up to version 1.1.4. The vulnerability is a Stored Cross-Site Scripting (XSS) via the htteamember shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It requires authenticated access at...
WordPress plugin WP Team 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...
WordPress HT Team Member plugin <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via htteamember Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin HT Team Member versions = 1.1.4...
GHSA-F77Q-R5QM-W4M8 sp1-recursion-gnark-ffi has insufficient range checks of BabyBear arithmetic
The Gnark recursion circuit constrains arithmetic over BabyBear when the native field of the ZKP circuit is the BN254 scalar field. Proper implementation of this logic requires range checking Bn254 values to be less than the BabyBear modulus. In versions 1.2.0, functions like InvF and InvE used...
WordPress HT Team Member Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)
Software HT Team Member Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10223 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7be4209fc593 Credits Peter Thaleikis Required...
CVE-2024-50469 WordPress Textboxes plugin <= 0.1.3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brightvesseldev Textboxes textboxes allows DOM-Based XSS.This issue affects Textboxes: from n/a through = 0.1.3.1...
CVE-2024-50469 WordPress Textboxes plugin <= 0.1.3.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brightvesseldev Textboxes textboxes allows DOM-Based XSS.This issue affects Textboxes: from n/a through = 0.1.3.1...
CVE-2024-50469
CVE-2024-50469 is a DOM-based XSS vulnerability in the WordPress Textboxes plugin (versions up to 0.1.3.1). The issue is described as Improper Neutralization of Input During Web Page Generation (XSS) affecting Textboxes; CVSS 3.1 base score 6.5 (Network, Low Privileges, User Interaction required,...
CVE-2024-50443
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Post Grid Team by WPXPO PostX allows Stored XSS.This issue affects PostX: from n/a through 4.1.12...
