CVE-2024-5883: Improper Neutralization of Input During Web Page Generation

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Ultimate Classified Listings Plugin < 1.3 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Classified Listings Type Plugin Vulnerable versions 1.3 Fixed in 1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5883 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 51c9f2d610f9 Credits Bob Matyas...

WordPress Ultimate Classified Listings Plugin < 1.3 is vulnerable to Local File Inclusion

Software Ultimate Classified Listings Type Plugin Vulnerable versions 1.3 Fixed in 1.3 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5882 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID b49a98246fbf Credits Project Black Required privilege...

PT-2024-37567 · WordPress · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: The Ultimate Blocks WordPress plugin versions prior to 3.2.0 Description: The issue concerns a lack of validation and escaping of certain post-grid block attributes in the plugin, which could allow users with the contributor role and above to...

CVE-2024-5882: Improper Limitation of a Pathname to a Restricted Directory

The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the uclpage and layout parameters allowing unauthenticated users to access PHP files on the server from the listings page...

CVE-2024-6362: Improper Neutralization of Input During Web Page Generation

The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-6591: Missing Authorization

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'sendauctionemailcallback' and 'resendauctionemailcallback' functions in all versions up to, and including, 4.2.7. This makes it possible fo...

CVE-2024-37259

The WP Extended (The Ultimate WordPress Toolkit) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.7 . The root cause is insufficient input sanitization and output escaping , which allows unauthenticated attackers to inject arbitrary web s...

CVE-2024-37263 WordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in ThemeLooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.6...

PT-2024-27423 · WordPress · Wp Extended

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended versions n/a through 2.4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Reflected XSS...

CVE-2024-37457

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks – Gutenberg Blocks Plugin allows Stored XSS.This issue affects Ultimate Blocks – Gutenberg Blocks Plugin: from n/a through 3.1.9...

CVE-2024-37457

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks – Gutenberg Blocks Plugin allows Stored XSS.This issue affects Ultimate Blocks – Gutenberg Blocks Plugin: from n/a through 3.1.9...

CVE-2024-37457 WordPress Ultimate Blocks – WordPress Blocks Plugin plugin <= 3.1.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks – Gutenberg Blocks Plugin allows Stored XSS.This issue affects Ultimate Blocks – Gutenberg Blocks Plugin: from n/a through 3.1.9...

CVE-2024-37457 WordPress Ultimate Blocks – WordPress Blocks Plugin plugin <= 3.1.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks – Gutenberg Blocks Plugin allows Stored XSS.This issue affects Ultimate Blocks – Gutenberg Blocks Plugin: from n/a through 3.1.9...

CVE-2024-37457

The CVE-2024-37457 pertains to the WordPress plugin “Ultimate Blocks – Gutenberg Blocks”. Affected versions are 3.1.9 and earlier, where the vulnerability arises from Improper Neutralization of Input During Web Page Generation, i.e., a Stored XSS flaw in the plugin. The issue enables stored cross...

CVE-2024-37512

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.10...

CVE-2024-37512

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Basix NEX-Forms – Ultimate Form Builder allows Stored XSS.This issue affects NEX-Forms – Ultimate Form Builder: from n/a through 8.5.10...

CVE-2024-37512

CVE-2024-37512 is a Stored XSS in Basix NEX-Forms – Ultimate Form Builder (WordPress plugin) affecting versions up to 8.5.10. The vulnerability stems from improper neutralization of input during web page generation. Public advisories from NVD/Red Hat and CVE records confirm the issue as Stored XS...

PT-2024-27568 · WordPress · Ultimate Blocks – Gutenberg Blocks Plugin

Name of the Vulnerable Software and Affected Versions: Ultimate Blocks – Gutenberg Blocks Plugin versions 3.1.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in the...

CVE-2024-37457: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks – Gutenberg Blocks Plugin allows Stored XSS.This issue affects Ultimate Blocks – Gutenberg Blocks Plugin: from n/a through 3.1.9...