WordPress WP Events Manager plugin <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection vulnerability

Authenticated Subscriber+ Time-Based SQL Injection vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin WP Events Manager versions = 2.1.11...

PT-2024-34307 · Unknown · Fluent Forms

Name of the Vulnerable Software and Affected Versions: Fluent Forms versions up to, and including, 5.1.18 Description: The issue is related to an insufficient capability check on the verifyRequest function, allowing Form Managers with a Subscriber-level access and above to modify the Mailchimp AP...

PT-2024-10840 · Nescalante · Url-Regex

Name of the Vulnerable Software and Affected Versions: nescalante urlregex versions up to 0.5.0 Description: A vulnerability was found in the nescalante urlregex component, affecting some unknown processing of the file index.js of the Backtracking component. The manipulation leads to inefficient...

Samsung Internet Browser SOP Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samsung Internet Browser SOP Bypass', 'Description' = %q This module takes advantage of a Same-Origin Policy SOP bypass vulnerability in the...

CVE-2024-4401

The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ and 'eaeslideranimation' parameters in all versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2024-38946 · Openrapid · Openrapid Rapidcms

Name of the Vulnerable Software and Affected Versions: OpenRapid RapidCMS versions up to 1.3.1 Description: A critical issue was found in OpenRapid RapidCMS, affecting the file /admin/user/user-move-run.php. The manipulation of the username argument leads to SQL injection. It is possible to...

PT-2024-38949 · Unknown · Master-Nan Sweet-Cms

Name of the Vulnerable Software and Affected Versions: master-nan Sweet-CMS up to 5f441e022b8876f07cde709c77b5be6d2f262e3f Description: A vulnerability was found in master-nan Sweet-CMS, affecting the function LogHandler of the file middleware/log.go. The manipulation leads to improper output...

CVE-2024-43948

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Dinesh Karki WP Armour Extended.This issue affects WP Armour Extended: from n/a through 1.26...

CVE-2024-43922

Improper Control of Generation of Code 'Code Injection' vulnerability in NitroPack Inc. NitroPack allows Code Injection.This issue affects NitroPack: from n/a through 1.16.7...

WordPress Fluida theme <= 1.8.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Fluida versions = 1.8.8...

WordPress Nirvana theme <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Nirvana versions = 1.6.3...

WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Theme Blogpoet versions = 1.0.3...

WordPress ElementsKit Pro plugin <= 3.6.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin ElementsKit Pro versions = 3.6.0...

WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou Patchstack Alliance in WordPress Theme Masterstudy LMS Starter versions = 1.1.8...

WordPress E-cab taxi booking manager plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 1.0.9...

WordPress Enhanced Search Box plugin <= 0.6.1 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Enhanced Search Box versions = 0.6.1...

PT-2024-30777 · WordPress · Ti Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: TI WooCommerce Wishlist versions n/a through 2.8.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This vulnerability affects over 100,000 sites...

WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joel Indra Patchstack Alliance in WordPress Plugin Ninja Forms versions = 3.8.11...

WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Theme Fota WP versions = 1.4.1...

WordPress Mollie Payments for WooCommerce plugin <= 7.7.0 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Mollie Payments for WooCommerce versions = 7.7.0...