CVE-2024-52047: Files or Directories Accessible to External Parties

A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...

WordPress plugin Widget Options has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-36753 · Unknown · Marketingfire Widget Options

Name of the Vulnerable Software and Affected Versions: MarketingFire Widget Options versions 4.0.6.1 and earlier Description: The issue is related to a missing authorization vulnerability in MarketingFire Widget Options, which allows exploiting incorrectly configured access control security level...

WordPress Float Block plugin <= 1.7 - Admin+ Stored XSS via Widget vulnerability

Admin+ Stored XSS via Widget vulnerability discovered by Bob Matyas in WordPress Plugin float block versions = 1.7...

WordPress Elementor Header & Footer Builder plugin <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Page Title Widget vulnerability discovered by wesley wcraft in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 1.6.46...

Foxit PDF Reader Code Execution

The vulnerability of the CBFWidget object handler in the PDF document viewing software Foxit PDF Reader formerly Foxit Reader is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, provided that the user opens a special...

CVE-2024-12588

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-12588 Shortcodes and extra features for Phlox theme <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widget

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-12588

CVE-2024-12588 concerns the WordPress plugin Shortcodes and extra features for Phlox theme. Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in the Phlox staff widget, arising from insufficient input sanitization and output escaping of user-supplied attributes. Affected...

PT-2024-16556 · WordPress · Full Screen Menu For Elementor

Name of the Vulnerable Software and Affected Versions: Full Screen Menu for Elementor plugin for WordPress versions up to, and including, 1.0.7 Description: The Full Screen Menu for Elementor plugin for WordPress has an Information Exposure issue due to insufficient restrictions on which posts ca...

CVE-2024-10797: Authorization Bypass Through User-Controlled Key

The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen Menu Elementor Widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers,...

PT-2024-17666 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.16.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Staff widget due to insufficient input sanitization and...

CVE-2024-12588: Improper Neutralization of Input During Web Page Generation

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress plugin Shortcodes and additional features for Phlox theme – Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

CVE-2024-56357

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the "javascript:" scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3....

CVE-2024-56357: Improper Neutralization of Input During Web Page Generation

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the javascript: scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3.1...

PT-2024-36799 · Unknown · Grist-Core

Name of the Vulnerable Software and Affected Versions: grist-core versions prior to 1.3.1 Description: A user visiting a malicious document or submitting a malicious form could have their account compromised due to the ability to use the javascript: scheme with custom widget URLs and form redirec...

WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Widget Options versions = 4.0.6.1...

CVE-2024-49576

A use-after-free vulnerability exists in the way Foxit Reader 2024.3.0.26795 handles a checkbox CBFWidget object. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An...

CVE-2024-49576

Foxit Reader 2024.3.0.26795 contains a use-after-free in handling the checkbox CBF_Widget object. A crafted PDF with JavaScript can trigger memory corruption and arbitrary code execution. Exploitation requires user interaction (opening the malicious file or visiting a malicious site if the browse...