CVE-2024-6766 Shortcodes Ultimate Pro < 7.2.1 - Contributor+ Stored XSS

The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attac...

CVE-2024-36424

K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service BSOD because of a NULL pointer dereference...

CVE-2024-36424

K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service BSOD because of a NULL pointer dereference...

WordPress plugin shortcodes-ultimate-pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

K7 Computing Ultimate Security 安全漏洞

K7 Computing Ultimate Security is a suite of antivirus software for the Windows platform from K7 Computing, USA. A security vulnerability exists in K7 Computing Ultimate Security prior to version 17.0.2019, which stems from a null pointer dereference vulnerability in K7RKScan.sys, which could lea...

PT-2024-37858 · WordPress · Shortcodes-Ultimate-Pro

Name of the Vulnerable Software and Affected Versions: shortcodes-ultimate-pro WordPress plugin versions prior to 7.2.1 Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the lack of validation and escaping of some shortco...

WordPress Shortcodes Ultimate Pro Plugin < 7.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Shortcodes Ultimate Pro Type Plugin Vulnerable versions 7.2.1 Fixed in 7.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6766 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID db236be8a8b4 Credits Dmitrii Ignatyev...

CVE-2024-36424

CVE-2024-36424 affects K7 Ultimate Security prior to version 17.0.2019, via the driver file K7RKScan.sys . The vulnerability is a NULL pointer dereference that, when triggered through IOCTLs 0x222010/0x222014, allows a local attacker to cause a denial of service (BSOD). Impact is a system crash; ...

CVE-2024-6529

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress plugin Ultimate Classified Listings 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Ultimate Classified Listings plugin < 1.3 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Bob Matyas in WordPress Plugin Ultimate Classified Listings versions 1.3...

WordPress Ultimate Classified Listings plugin < 1.3 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by Project Black in WordPress Plugin Ultimate Classified Listings versions 1.3...

CVE-2024-6362

The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-5882

The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the uclpage and layout parameters allowing unauthenticated users to access PHP files on the server from the listings page...

CVE-2024-6362

The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-6362 Ultimate Blocks < 3.2.0 - Contributor+ Stored XSS

The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-5883 Ultimate Classified Listings < 1.3 - Reflected XSS

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6362

Summary of CVE-2024-6362 (WordPress Ultimate Blocks plugin) : The plugin (versions prior to 3.2.0) fails to validate and escape certain post-grid block attributes when outputting them in pages/posts where the block is embedded. This underlying issue can enable stored cross-site scripting (Stored ...

CVE-2024-5882 Ultimate Classified Listings < 1.3 - Unauthenticated LFI

The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the uclpage and layout parameters allowing unauthenticated users to access PHP files on the server from the listings page...

WordPress Ultimate Auction plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation vulnerability

Missing Authorization to Unauthenticated Email Creation vulnerability discovered by Lucio Sá in WordPress Plugin Ultimate Auction versions = 4.2.7...