PT-2024-15238 · WordPress · Backup/Restore Wordpress – Backup Plugin

Name of the Vulnerable Software and Affected Versions: Backup and Restore WordPress plugin versions 1.45 and earlier Description: The issue allows unauthenticated users to access sensitive information, such as site configuration, by not protecting some log files. This poses a severe threat to...

PT-2023-31643 · Jenkins · Jenkins Htmlresource Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HTMLResource Plugin versions 1.02 and earlier Description: A cross-site request forgery CSRF issue allows attackers to delete arbitrary files on the Jenkins controller file system. This can be exploited by attackers to potentially...

CVE-2022-3700

A Time of Check Time of Use TOCTOU vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files...

PT-2023-29823 · Emmanuel Georjon · Eg-Attachments

Name of the Vulnerable Software and Affected Versions: Emmanuel GEORJON EG-Attachments plugin versions = 2.1.3 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing them ...

CVE-2023-44261

Cross-Site Request Forgery CSRF vulnerability in Dinesh Karki Block Plugin Update plugin = 3.3 versions...

CVE-2023-44261

CVE-2023-44261 is a CSRF vulnerability in WordPress Block Plugin Update (

PT-2023-29157 · Huseyin Berberoglu · Wp Hide Pages

Name of the Vulnerable Software and Affected Versions: Huseyin Berberoglu WP Hide Pages plugin version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is...

PT-2023-27315 · Unknown · Imagerecycle Pdf & Image Compression Plugin

Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression plugin versions = 3.1.11 Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing...

PT-2023-13578 · WordPress · Metagauss Download Theme

Name of the Vulnerable Software and Affected Versions: Metagauss Download Theme plugin versions 1.0.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...

WordPress Plugin "Snow Monkey Forms" vulnerable to directory traversal

Overview WordPress Plugin "Snow Monkey Forms" provided by Monkey Wrench Inc. contains a directory traversal vulnerability CWE-22. Shinsaku Nomura of Bitforest Co.,Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

PT-2023-25382 · WordPress · Woocommerce Paypal Payments

Name of the Vulnerable Software and Affected Versions: WooCommerce PayPal Payments plugin versions = 2.0.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

JVN#95792402: WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" vulnerable to cross-site scripting

WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" provided by Vektor,Inc. contain multiple cross-site scripting vulnerabilities CWE-79 listed below. Cross-site scripting vulnerability in Tag edit function - CVE-2023-27923 Version| Vector| Score ---|---|--- CVSS v3|...

WordPress Plugin "Appointment and Event Booking Calendar for WordPress - Amelia" vulnerable to cross-site scripting

Overview WordPress Plugin "Appointment and Event Booking Calendar for WordPress - Amelia" provided by TMS contains a cross-site scripting vulnerability CWE-79. Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to the developer and coordinated. The developer and JPCERT/...

CVE-2023-1028

The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the setIgnore function. This makes it possible for unauthenticated attackers to update plugin options via a forged...

WordPress plugin WP Meta SEO 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Slider Revolution 4.6.5 Shell Upload

==================================================================================================================================== | Title : WordPress - Slider Revolution 4.6.5 WordPress - Slider Revolution 4.6.5 shell upload 0-day exploit | | Author : indoushka | | Tested on : windows 10...

WordPress Rock Convert plugin <= 2.10.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by José Ricardo in the WordPress Rock Convert plugin versions = 2.10.2. Solution Update the WordPress Rock Convert plugin to the latest available version at least 2.11.0...

PT-2022-15145 · WordPress · Advanced Wordpress Reset

Name of the Vulnerable Software and Affected Versions: Advanced WordPress Reset WordPress plugin versions prior to 1.6 Description: The issue concerns Reflected Cross-Site Scripting. It occurs because some generated URLs are not properly escaped before being outputted back in href attributes of...

CVE-2022-29495

Cross-Site Request Forgery CSRF vulnerability in Sygnoos Popup Builder plugin = 4.1.11 at WordPress allows an attacker to update plugin settings...

CVE-2022-29495

Concisely: The WordPress plugin Sygnoos Popup Builder (WP Plugin: Popup Builder) is affected up to version 4.1.11 by a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to update plugin settings. The root cause is insufficient CSRF protection in settings update handling. Rep...