CVE-2024-31304

CVE-2024-31304 describes a Missing Authorization vulnerability (Broken Access Control) in the WordPress plugin/DC WooCommerce MultiVendorX Marketplace, affecting WC Marketplace versions up to 4.1.3. Public records indicate high impact (C, I, A: High) with CVSS v3.1 base metrics showing network at...

WordPress plugin WC Marketplace security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-34765 WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Sensei Sensei Pro WC Paid Courses allows Stored XSS.This issue affects Sensei Pro WC Paid Courses: from n/a through 4.23.1.1.23.1...

CVE-2024-34765 WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Sensei Sensei Pro WC Paid Courses allows Stored XSS.This issue affects Sensei Pro WC Paid Courses: from n/a through 4.23.1.1.23.1...

CVE-2024-34765

CVE-2024-34765 is a Stored XSS in Sensei Pro (WC Paid Courses) for Sensei LMS, affecting Sensei Pro: from n/a through 4.23.1.1.23.1. Red Hat’s advisory reiterates the same description. The initial data indicates this requires updating Sensei Pro to a fixed version (4.23.1.1.23.1) to mitigate the ...

WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Sensei Pro WC Paid Courses versions = 4.23.1.1.23.1...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Broken Access Control

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35686 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5a225c011e38 Credits...

WordPress WC Marketplace Plugin <= 4.1.11 is vulnerable to Cross Site Scripting (XSS)

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.11 Fixed in 4.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5259 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID df73d304db61 Credits stealthcopter Required...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Cross Site Scripting (XSS)

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ffa624f39abc Credits Rafie...

WC Marketplace < 4.1.4 - Missing Authorization

Description The WC Marketplace plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action...

WordPress WC Marketplace Plugin <= 4.1.3 is vulnerable to Broken Access Control

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.3 Fixed in 4.1.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31304 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 245d71ae2d23 Credits LVT-tholv2k Required...

WC Marketplace < 4.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WC Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inje...

WC Builder < 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WC Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2024-30433

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3...

CVE-2024-30433 WordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3...

CVE-2024-30433

CVE-2024-30433: Stored XSS in MultiVendorX (DC-woocommerce-multi-vendor) WC Marketplace plugin. Affected: WC Marketplace versions up to 4.1.3. Root cause: improper neutralization of input during web page generation. Impact: potential cross-site scripting; estimated CVSS v3.1 base score 6.5 (Mediu...

PT-2024-23361 · Unknown · Multivendorx Wc Marketplace

Name of the Vulnerable Software and Affected Versions: MultiVendorX WC Marketplace versions n/a through 4.1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

WordPress WC Marketplace Plugin <= 4.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.3 Fixed in 4.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30433 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5bd23685e626 Credits LVT-tholv2k Required privilege...

CVE-2024-29929 WordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.7.8...

CVE-2024-29929

CVE-2024-29929 describes a Stored XSS in WCFM – Frontend Manager for WooCommerce . It arises from improper neutralization of user input during web page generation, enabling arbitrary script execution in stored form. Affected versions are listed as from n/a through 6.7.8. The vulnerability is char...