WordPress plugin Ultimate Member 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Ultimate Member Plugin <= 2.8.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Ultimate Member Type Plugin Vulnerable versions = 2.8.6 Fixed in 2.8.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8520 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7e0506c6b50a Credits Jack Taylor Required...

CVE-2024-8520: Cross-Site Request Forgery (CSRF)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admininit or...

WordPress plugin Ultimate Member 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

WordPress Ultimate Member Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Member Type Plugin Vulnerable versions = 2.8.6 Fixed in 2.8.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8519 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 824f62c298fa Credits Jack Taylor Required...

CVE-2024-8519: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'umloggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input...

PT-2024-39070 · WordPress · The Ultimate Member

Name of the Vulnerable Software and Affected Versions: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress versions up to, and including, 2.8.6 Description: The issue is related to Stored Cross-Site Scripting via...

WordPress Ultimate Store Kit Elementor Addons plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 2.0.5...

WordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Enter Addons versions = 2.1.8...

WordPress Ultimate Blocks plugin < 3.2.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ultimate Blocks versions 3.2.2...

CVE-2024-8536

The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-8536 Ultimate Blocks < 3.2.2 - Contributor+ Stored XSS

The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-8536 Ultimate Blocks < 3.2.2 - Contributor+ Stored XSS

The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-8536: Improper Neutralization of Input During Web Page Generation

The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.7.3 is vulnerable to Cross Site Scripting (XSS)

Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions = 8.7.3 Fixed in 8.7.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47389 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6ed1c15130e3 Credits Le Ngoc Anh...

WordPress Ultimate Blocks – Gutenberg Blocks Plugin Plugin < 3.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Blocks – Gutenberg Blocks Plugin Type Plugin Vulnerable versions 3.2.2 Fixed in 3.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8536 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8aef462831eb Credits...

WordPress plugin Ultimate Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Ultimate Store Kit Elementor Addons Plugin <= 2.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Store Kit Elementor Addons Type Plugin Vulnerable versions = 2.0.5 Fixed in 2.0.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47629 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e081deb07019 Credits João Pedro S...

PT-2024-39078 · WordPress · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: The Ultimate Blocks WordPress plugin versions prior to 3.2.2 Description: The issue is related to the Ultimate Blocks WordPress plugin, which does not validate and escape some of its block attributes before outputting them back in a page or...

CVE-2024-9069: Improper Neutralization of Input During Web Page Generation

The Graphicsly – The ultimate graphics plugin for WordPress website builder Gutenberg, Elementor, Beaver Builder, WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and...