CVE-2024-8286

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks...

CVE-2023-5529

The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-5529 Advanced Page Visit Counter <= 8.0.6 - Admin+ Stored XSS

The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8286

The CVE-2024-8286 entry concerns the WordPress plugin webtoffee-gdpr-cookie-consent prior to version 2.6.1, which reportedly lacks CSRF checks in certain bulk actions. Public sources in the connected documents confirm that this could allow an attacker to cause logged-in admins to perform unintend...

CVE-2025-4706

A vulnerability was found in projectworlds Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Procedure3byearwiseVisit.php. The manipulation of the argument Visityear leads to sql injection. The attack can be initiated remotely. T...

Projectworlds Online Examination System 注入漏洞

Projectworlds Online Examination System is an online examination system from Projectworlds India. Projectworlds Online Examination System version 1.0 suffers from an injection vulnerability that stems from SQL injection due to incorrect manipulation of the parameter Visityear in the file...

End-to-End Encrypted Texts Between Android and iPhone Are Coming

Plus: A nominee to lead CISA emerges, Elon Musk visits the NSA, a renowned crypto cracking firm’s secret and problematic cofounder is revealed, and more...

CVE-2024-32098

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Page Visit Counter Advanced Page Visit Counter.This issue affects Advanced Page Visit Counter: from n/a through 8.0.6...

CVE-2025-0743

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/" to obtain information about the visits made by other users. The information provided by this endpoint includes IP...

CVE-2025-0743 Improper Access Control vulnerability in EmbedAI

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/" to obtain information about the visits made by other users. The information provided by this endpoint includes IP...

CVE-2025-0743

CVE-2025-0743 affects EmbedAI 2.1 and earlier. Affected component: the /embedai/visits/show/ endpoints, whose access control is insufficient, allowing an authenticated attacker to obtain information about other users’ visits (IP address, user agent, and location). This is described across multipl...

PT-2025-4032 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and earlier Description: A control access issue has been identified, allowing an authenticated attacker to exploit the "/embedai/visits/show/" endpoint to obtain information about visits made by other users. The informati...

CVE-2025-23470

Cross-Site Request Forgery CSRF vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through = 1.0...

CVE-2025-23470 WordPress Visit Site Link enhanced plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through = 1.0...

CVE-2025-23470

CVE-2025-23470 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Visit Site Link enhanced WordPress plugin that enables Stored XSS. Affected: Visit Site Link enhanced (affected range n/a–1.0). Exploitation details, impact magnitude, and remediation are not provided beyond the des...

CVE-2025-23470 WordPress Visit Site Link enhanced plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through = 1.0...

WordPress Visit Site Link enhanced plugin <= 1.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Visit Site Link enhanced versions = 1.0...

PT-2025-4895 · Unknown · Visit Site Link

Name of the Vulnerable Software and Affected Versions: Visit Site Link enhanced versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

WordPress plugin Visit Site Link enhanced 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2023-38479

Missing Authorization vulnerability in codents Simple Googlebot Visit simple-googlebot-visit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Googlebot Visit: from n/a through = 1.2.4...