CVE-2024-34765

CVE-2024-34765 is a Stored XSS in Sensei Pro (WC Paid Courses) for Sensei LMS, affecting Sensei Pro: from n/a through 4.23.1.1.23.1. Red Hat’s advisory reiterates the same description. The initial data indicates this requires updating Sensei Pro to a fixed version (4.23.1.1.23.1) to mitigate the ...

CVE-2024-34765: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Sensei Sensei Pro WC Paid Courses allows Stored XSS.This issue affects Sensei Pro WC Paid Courses: from n/a through 4.23.1.1.23.1...

PT-2024-26173

Name of the Vulnerable Software and Affected Versions Sensei Pro WC Paid Courses versions 4.23.1.1.23.1 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an...

WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Sensei Pro WC Paid Courses versions = 4.23.1.1.23.1...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Broken Access Control

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35686 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5a225c011e38 Credits...

WordPress WC Marketplace Plugin <= 4.1.11 is vulnerable to Cross Site Scripting (XSS)

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.11 Fixed in 4.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5259 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID df73d304db61 Credits stealthcopter Required...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Cross Site Scripting (XSS)

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ffa624f39abc Credits Rafie...

WC Marketplace < 4.1.4 - Missing Authorization

Description The WC Marketplace plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action...

WordPress WC Marketplace Plugin <= 4.1.3 is vulnerable to Broken Access Control

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.3 Fixed in 4.1.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31304 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 245d71ae2d23 Credits LVT-tholv2k Required...

WC Marketplace < 4.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WC Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inje...

WC Builder < 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WC Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

CVE-2024-30433

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3...

CVE-2024-30433

CVE-2024-30433: Stored XSS in MultiVendorX (DC-woocommerce-multi-vendor) WC Marketplace plugin. Affected: WC Marketplace versions up to 4.1.3. Root cause: improper neutralization of input during web page generation. Impact: potential cross-site scripting; estimated CVSS v3.1 base score 6.5 (Mediu...

CVE-2024-30433 WordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3...

PT-2024-23361 · Unknown · Multivendorx Wc Marketplace

Name of the Vulnerable Software and Affected Versions: MultiVendorX WC Marketplace versions n/a through 4.1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

CVE-2024-30433: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3...

WordPress WC Marketplace Plugin <= 4.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.3 Fixed in 4.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30433 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5bd23685e626 Credits LVT-tholv2k Required privilege...

CVE-2024-29929

CVE-2024-29929 describes a Stored XSS in WCFM – Frontend Manager for WooCommerce . It arises from improper neutralization of user input during web page generation, enabling arbitrary script execution in stored form. Affected versions are listed as from n/a through 6.7.8. The vulnerability is char...

CVE-2024-29929 WordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.7.8...

CVE-2024-29926

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes WC Builder allows Stored XSS.This issue affects WC Builder: from n/a through 1.0.18...