WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability

Arbitrary File Download and Deletion vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Sendinblue for WooCommerce versions = 4.0.17...

WordPress Better Messages plugin <= 2.4.32 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin BP Better Messages versions = 2.4.32...

WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Easy Property Listings versions = 3.5.3...

WordPress Seers plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) to XSS vulnerability

Cross Site Request Forgery CSRF to XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Seers versions = 8.1.0...

WordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Advanced Testimonial Carousel for Elementor versions = 3.0.0...

WordPress Embed Google Photos album plugin <= 2.1.9 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Embed Google Photos album versions = 2.1.9...

WordPress ChatBot Conversational Forms plugin <= 1.1.8 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Conversational Forms for ChatBot versions = 1.1.8...

WordPress SchedulePress plugin <= 5.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin SchedulePress versions = 5.0.8...

WordPress StreamWeasels Twitch Integration plugin <= 1.7.8 - API Sensitive Data Exposure vulnerability

API Sensitive Data Exposure vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin StreamWeasels Twitch Integration versions = 1.7.8...

WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Olive One Click Demo Import versions = 1.1.1...

CVE-2024-32682

Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2...

CVE-2024-32681

Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2...

WordPress User Registration plugin <= 3.1.5 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Stiofan in WordPress Plugin User Registration versions = 3.1.5...

SUSE CVE-2023-52645

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix race conditions with genpd If the power domains are registered first with genpd and after that the driver attempts to power them on in the probe sequence, then it is possible that a race condition occurs i...

The vulnerability of Intel Wake Up Latency Tracer software lies in its use of an unreliable search path, allowing a hacker to execute arbitrary code or enhance their privileges.

The vulnerability of Intel Wake Up Latency Tracer software is related to the use of an unreliable search path. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or gain increased privileges...

PT-2024-24710 · Thimpress · Thimpress Learnpress Export Import

Name of the Vulnerable Software and Affected Versions: ThimPress LearnPress Export Import versions n/a through 4.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an...

WordPress Plugin CataBlog 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

PT-2024-22164 · Akana · Akana Api Platform +1

Name of the Vulnerable Software and Affected Versions: Akana API Platform versions prior to and including 2022.1.3 Akana Community Manager Developer Portal versions prior to and including 2022.1.3 Description: A server-side request forgery SSRF issue was discovered. This issue allows an attacker ...

WordPress Plugin Mega Elements 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2024-18036 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.6.0 Description: The issue is related to Stored Cross-Site Scripting via the link attribute of the Price List widget due to insufficient input sanitizatio...