Malware Campaign Lures Users With Fake W2 Form

The following analysts contributed to the research: Evan McCann, Matt Smith, Ipek Solak, Jake McMahon Rapid7 has recently observed an campaign targeting users searching for W2 forms using the Microsoft search engine Bing. Users are subsequently directed to a fake IRS website, enticing them to...

WordPress plugin Social Auto Poster 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2024-38344

A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintende...

CVE-2024-38344

A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintende...

CVE-2024-38344

CVE-2024-38344 affects WP Tweet Walls versions prior to 1.0.4. The issue is a cross-site request forgery (CSRF) vulnerability that could allow a logged-in user on a WordPress site with the affected plugin enabled to access a malicious page and perform unintended operations. The available connecte...

CVE-2024-38344

A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintende...

PT-2024-27947 · WordPress · Wp Tweet Walls

Name of the Vulnerable Software and Affected Versions: WP Tweet Walls versions prior to 1.0.4 Description: A cross-site request forgery issue exists, allowing an attacker to trick a user into accessing a malicious page when logged in to a WordPress site with the affected plugin enabled. This coul...

WordPress plugins "WP Tweet Walls" and "Sola Testimonials" vulnerable to cross-site request forgery

Overview WordPress plugins "WP Tweet Walls" and "Sola Testimonials" provided by Sola Plugins contain a cross-site request forgery vulnerability CWE-352. These vulnerabilities are reported by the following reporters, and JPCERT/CC coordinated with the developer under Information Security Early...

CVE-2024-2492 PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget

The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Tweet widget in all versions up to, and including, 2.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2492 PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget

The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Tweet widget in all versions up to, and including, 2.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress PowerPack Addons for Elementor plugin <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Twitter Tweet Widget vulnerability discovered by wesley wcraft in WordPress Plugin PowerPack Addons for Elementor versions = 2.7.18...

CVE-2024-0700

The Simple Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tweet this text value in all versions up to, and including, 1.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access a...

CVE-2024-0700 Simple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting

The Simple Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tweet this text value in all versions up to, and including, 1.4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access a...

CVE-2024-0700

CVE-2024-0700 is a Stored XSS affecting WordPress Simple Tweet plugin up to version 1.4.0.2 due to insufficient input sanitization and output escaping. An attacker with author-level access (authenticated) can inject scripts that execute when users load injected pages. Root cause: inadequate sanit...

WordPress Plugin Simple Tweet Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Simple Tweet Plugin <= 1.4.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Simple Tweet Type Plugin Vulnerable versions = 1.4.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0700 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ab2aad4c0181 Credits Benachi Required privilege...

PT-2024-13910 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason stating that the information is unuse...

PT-2024-14580 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason stating that the information is unuse...

PT-2024-13043 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason stating that the referenced item is...

PT-2024-13878 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason stating that the item is unused, alon...