WordPress Slickstream Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Slickstream Type Plugin Vulnerable versions = 1.4.4 Fixed in 2.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10179 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 483fb63a8894 Credits Peter Thaleikis Required...

WordPress plugin Slickstream: Engagement and Conversions 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2024-16093 · WordPress · Slickstream

Name of the Vulnerable Software and Affected Versions: Slickstream: Engagement and Conversions plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's slick-grid shortcode due to insufficient input sanitization an...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

DrayTek Vigor 2960 安全漏洞

The DrayTek Vigor 2960 is a dual WAN broadband router/VPN gateway from China DrayTek. A security vulnerability exists in the DrayTek Vigor 2960 version 1.4.4, which stems from an authorized remote code execution vulnerability that results in malicious commands that can be executed by system...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

WordPress WP Easy Post Types plugin <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection vulnerability

Authenticated Subscriber+ PHP Object Injection vulnerability discovered by István Márton in WordPress Plugin Easy Post Types versions = 1.4.4...

CVE-2024-10080

The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

PT-2024-16014 · WordPress · Wp Easy Post Types

Name of the Vulnerable Software and Affected Versions: WP Easy Post Types plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to Stored Cross-Site Scripting via post meta due to insufficient input sanitization and output escaping on user-supplied attributes...

WordPress plugin WP Easy Post Types 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin WP Easy Post Types 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

WordPress WP Easy Post Types plugin <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions vulnerability

Authenticated Subscriber+ Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin Easy Post Types versions = 1.4.4...

WordPress WP Easy Post Types plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Post Meta vulnerability discovered by István Márton in WordPress Plugin Easy Post Types versions = 1.4.4...

playSMS 代码注入漏洞

playSMS is an open source SMS Short Message Service management software from Anton Raharja, an individual developer in India. A code injection vulnerability exists in playSMS versions 1.4.4 through 1.4.7, which stems from the parameter username/email/captcha in the file...

CVE-2024-8622

The CVE-2024-8622 entry concerns the amCharts: Charts and Maps plugin for WordPress. Affected versions are

WordPress amCharts: Charts and Maps plugin <= 1.4.4 - Reflected Cross-Site Scripting via Cross-Site Request Forgery vulnerability

Reflected Cross-Site Scripting via Cross-Site Request Forgery vulnerability discovered by Krzysztof Zając in WordPress Plugin amCharts: Charts and Maps versions = 1.4.4...

PT-2024-39137 · WordPress · Amcharts

Name of the Vulnerable Software and Affected Versions: amCharts: Charts and Maps plugin for WordPress versions up to, and including, 1.4.4 Description: The issue allows unauthenticated attackers to inject arbitrary web scripts in pages through Reflected Cross-Site Scripting via the amcharts...

WordPress WPZOOM Portfolio Lite plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via align Attribute vulnerability discovered by Francesco Carlucci in WordPress Plugin WPZOOM Portfolio versions = 1.4.4...

WordPress plugin WPZOOM Portfolio Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

CVE-2023-3419

CVE-2023-3419 concerns tagDiv Opt-In Builder (WordPress plugin) with a Blind SQL Injection in the couponId parameter of the recreate_stripe_subscription REST endpoint. Affected versions up to and including 1.4.4 allow an authenticated administrator to append SQL statements to existing queries, en...