CVE-2024-54391

CVE-2024-54391 : Cross-Site Request Forgery (CSRF) leads to Stored XSS in the WordPress Filter plugin. Affected: WordPress Filter with versions up to 1.4.1 (no public details on root cause beyond CSRF-XSS linkage in the provided documents). Connected sources corroborate the CSRF-to-XSS descriptio...

PT-2024-36278 · WordPress · Matt Walters Wordpress Filter

Name of the Vulnerable Software and Affected Versions: Matt Walters WordPress Filter versions 1.4.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2024-54307

Cross-Site Request Forgery CSRF vulnerability in aipost AIcomments aicomments allows Cross Site Request Forgery.This issue affects AIcomments: from n/a through = 1.4.1...

CVE-2024-54307 WordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in aipost AIcomments aicomments allows Cross Site Request Forgery.This issue affects AIcomments: from n/a through = 1.4.1...

CVE-2024-54307 WordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in aipost AIcomments aicomments allows Cross Site Request Forgery.This issue affects AIcomments: from n/a through = 1.4.1...

WordPress plugin AIcomments 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2024-17311 · WordPress · Add Infos To The Events Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Add infos to the events calendar plugin for WordPress versions up to, and including, 1.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'fuss' shortcode due to insufficient input sanitization and output...

WordPress plugin Add infos to the events calendar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2024-12283

The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

WordPress Waymark plugin <= 1.4.1 - Reflected Cross-Site Scripting via 'content' vulnerability

Reflected Cross-Site Scripting via 'content' vulnerability discovered by vgo0 in WordPress Plugin Waymark versions = 1.4.1...

WordPress plugin WP Pipes 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress Designer plugin <= 1.4.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Designer versions = 1.4.1...

WordPress Pulsating Chat Button plugin <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Pulsating Chat Button versions = 1.4.1...

Apache Answer: Predictable Authorization Token Using UUIDv1

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1,...

WordPress plugin Fota WP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-30844 · Cozythemes · Cozythemes Fota Wp

Name of the Vulnerable Software and Affected Versions: CozyThemes Fota WP versions 1.4.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For CozyThemes Fota...

WordPress plugin My Favorites 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-32524 · Unknown · Classic Widgets +1

Name of the Vulnerable Software and Affected Versions: WPGrim Classic Editor and Classic Widgets versions 1.4.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows attackers to...

Malicious code in nuxtjs_dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dcd288c0cffc74a3b962530a540a7cc62f2288445fd2f50c7aded40160d08871 The OpenSSF Package Analysis project identified 'nuxtjsdotenv' @ 1.4.1 npm as malicious. It is considered malicious because: - The package...

WordPress My Favorites plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 Patchstack Alliance in WordPress Plugin My Favorites versions = 1.4.1...