CVE-2024-7855

CVE-2024-7855 affects the WordPress plugin WP Hotel Booking (versions

PT-2024-39343 · WordPress · Pwa — Easy Way To Progressive Web App

Name of the Vulnerable Software and Affected Versions: The PWA — easy way to Progressive Web App plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output...

WordPress plugin PWA — easy way to Progressive Web App 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin WP Hotel Booking 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2024-8624 · Cisco · Cisco Nexus Dashboard Fabric Controller

Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard Fabric Controller NDFC versions affected versions not specified Description: The issue is related to a lack of authorization in the implementation of the Cisco NDFC platform's application programming interface. This coul...

PT-2024-39470 · WordPress · Demo Importer Plus

Name of the Vulnerable Software and Affected Versions: Demo Importer Plus plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

Zenario CMS 安全漏洞

Zenario CMS is an open source application. Provides a Web-based content management system . A security vulnerability exists in Zenario CMS version 9.7.61188. The vulnerability stems from the application's lack of effective validation of uploaded files. An attacker can exploit the vulnerability to...

CVE-2024-9118

The QS Dark Mode Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9118

CVE-2024-9118 affects the QS Dark Mode Plugin for WordPress (versions ≤ 2.9). It yields stored XSS via SVG file uploads due to insufficient input sanitization and output escaping, exploitable by authenticated users with Author-level access or higher. Public references corroborate the vulnerabilit...

CVE-2024-9304

The LocateAndFilter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abov...

CVE-2024-9272

The R Animated Icon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9274

The Elastik Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9108

The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convertremoteimagetolocal' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the...

CVE-2024-9119

The SVG Complete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2024-9304

CVE-2024-9304 affects the WordPress LocateAndFilter plugin up to and including version 1.6.14, allowing Stored Cross-Site Scripting via SVG file uploads by authenticated users with Author-level access or higher. Connected sources confirm the vulnerability and targeted component (LocateAndFilter) ...

CVE-2024-9274

The CVE CVE-2024-9274 affects Elastik Page Builder for WordPress, with Stored Cross-Site Scripting via SVG file uploads in all versions up to 0.27.4 due to insufficient input sanitization and output escaping. Exploitation requires Author-level access or higher, and injected scripts run when a use...

CVE-2024-9108

The CVE-2024-9108 entry concerns the WordPress plugin Wechat Social login (WeChat) for WordPress. Connected sources confirm the vulnerability exists in versions up to 1.3.0, enabling unauthenticated arbitrary file uploads via convert_remoteimage_to_local, with potential remote code execution. No ...

CVE-2024-8107

The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-8107

The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.7.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

WordPress Slider Revolution plugin <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by wesley wcraft in WordPress Plugin Slider Revolution versions = 6.7.18...