WordPress Catch Base theme <= 3.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Theme Catch Base versions = 3.4.6...

WordPress Wheel of Life plugin <= 1.1.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hunter85 Patchstack Alliance in WordPress Plugin Wheel of Life versions = 1.1.8...

WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability

Broken Access Control on Email Verification vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Fluent Support versions = 1.8.0...

CVE-2024-3866

The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-8741 Beam me up Scotty – Back to Top Button <= 1.0.21 - Reflected Cross-Site Scripting

The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject...

PT-2024-39372 · WordPress · Wp Gpx Map

Name of the Vulnerable Software and Affected Versions: WP GPX Maps plugin for WordPress versions up to, and including, 1.7.08 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'sgpx' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-38569 · WordPress · Jupiter X Core

Name of the Vulnerable Software and Affected Versions: Jupiter X Core plugin for WordPress versions up to, and including, 4.6.5 Description: The Jupiter X Core plugin for WordPress is vulnerable to arbitrary file uploads due to a mishandled file type validation in the validate function. This make...

WordPress plugin Beam me up Scotty 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress Beam me up Scotty plugin <= 1.0.21 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Beam me up Scotty versions = 1.0.21...

WordPress Special Text Boxes plugin <= 6.2.4 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Francesco Carlucci in WordPress Plugin Special Text Boxes versions = 6.2.4...

WordPress Review & testimonial widgets plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin Review & testimonial widgets versions = 1.0.5...

WordPress Truepush plugin <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Truepush versions = 1.0.8...

WordPress Users Control plugin <= 1.0.16 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin Users Control versions = 1.0.16...

WordPress WP Newsletter Subscription plugin <= 1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin WP Newsletter Subscription versions = 1.1...

WordPress WPSPX plugin <= 1.0.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin WPSPX versions = 1.0.2...

kernel: HID: i2c-hid-of: fix NULL-deref on failed power up

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures...

kernel: firmware: cs_dsp: Return error if block header overflows file

A denial of service vulnerability was found in the Linux kernel. No error was returned from the csdsppowerup function if a block header is longer than the amount of data left in the file...

WordPress Koko Analytics plugin <= 1.3.12 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Koko Analytics versions = 1.3.12...

kernel: mlxsw: spectrum: Protect driver from buggy firmware

A vulnerability was found in the Linux kernel's mlxsw spectrum driver, where processing port up/down events leads to a NULL pointer dereference. This issue occurs when the driver fails to handle events for the CPU port, which exists but lacks a corresponding network device, resulting in system...

kernel: HID: i2c-hid-of: fix NULL-deref on failed power up

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures...