Sub2API 安全漏洞

Sub2API is an API gateway platform developed by Wesley Liddick. Versions of Sub2API prior to 0.1.85 contained security vulnerabilities; these vulnerabilities were caused by password reset attacks, which could lead to account takeover...

WordPress Elementor Addon Elements plugin <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Twitter Widget vulnerability discovered by wesley wcraft in WordPress Plugin Elementor Addon Elements versions = 1.13.3...

WordPress Premium Addons PRO plugin <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor Module vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Custom Mouse Cursor Module vulnerability discovered by wesley wcraft in WordPress Plugin Premium Addons PRO versions = 2.9.12...

WordPress Royal Elementor Addons and Templates plugin <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Royal Elementor Addons versions = 1.3.971...

WordPress WPCOM Member plugin <= 1.7.16 - Authentication Bypass via Weak OTP vulnerability

Authentication Bypass via Weak OTP vulnerability discovered by wesley wcraft in WordPress Plugin WPCOM Member versions = 1.7.16...

WordPress miniOrange Social Login and Register Pro Addon plugin <= 200.3.9 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin miniOrange Social Login and Register Pro Addon versions = 200.3.9...

WordPress WPCOM Member plugin <= 1.7.5 - Authentication Bypass via 'user_phone' vulnerability

Authentication Bypass via 'userphone' vulnerability discovered by wesley wcraft in WordPress Plugin WPCOM Member versions = 1.7.5...

WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.6 - Unauthenticated User Information Exposure vulnerability

Unauthenticated User Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin Post Grid and Gutenberg Blocks versions = 2.3.6...

WordPress Classified Listing – Classified ads & Business Directory Plugin plugin <= 4.0.4 - Unauthenticated Settings Exposure vulnerability

Unauthenticated Settings Exposure vulnerability discovered by wesley wcraft in WordPress Plugin Classified Listing versions = 4.0.4...

WordPress Pie Register plugin <= 3.8.4 - Sensitive Information Exposure via Log Files vulnerability

Sensitive Information Exposure via Log Files vulnerability discovered by wesley wcraft in WordPress Plugin Pie Register versions = 3.8.4...

WordPress Groundhogg plugin <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function vulnerability

Authenticated Author+ Arbitrary File Upload via ghbigfileupload Function vulnerability discovered by wesley wcraft in WordPress Plugin Groundhogg versions = 3.7.3.5...

WordPress Social Login plugin <= 5.9.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin Social Login versions = 5.9.0...

WordPress User Meta plugin <= 3.1 - Insecure Direct Object Reference to Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin User Meta versions = 3.1...

WordPress Heateor Social Login WordPress plugin <= 1.1.35 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin Heateor Social Login versions = 1.1.35...

WordPress Heateor Social Login Plugin <= 1.1.35 is vulnerable to Broken Authentication

Software Heateor Social Login Type Plugin Vulnerable versions = 1.1.35 Fixed in 1.1.36 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-10020 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 0cb2e3c4d2f1 Credits...

WordPress Social Login - WordPress Plugin plugin <= 2.7.7 - Authentication Bypass vulnerability

WordPress Social Login - WordPress Plugin plugin = 2.7.7 - Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin WooCommerce Social Login versions = 2.7.7...

WordPress Loginizer plugin <= 1.9.2 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin Loginizer versions = 1.9.2...

WordPress Loginizer Security Plugin <= 1.9.2 is vulnerable to Broken Authentication

Software Loginizer Security Type Plugin Vulnerable versions = 1.9.2 Fixed in 1.9.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-10097 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 39d130db7003 Credits...

WordPress Wp Social Login and Register Social Counter plugin <= 3.0.7 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin Wp Social versions = 3.0.7...

WordPress Wp Social Plugin <= 3.0.7 is vulnerable to Broken Authentication

Software Wp Social Type Plugin Vulnerable versions = 3.0.7 Fixed in 3.0.8 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2024-9501 Patch priority High CVSS severity High 9.8 Developer Wpmet PSID 239b8bacd5e7 Credits wesley wcraft Required privilege...