WordPress Livemesh SiteOrigin Widgets plugin <= 2.8.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Livemesh SiteOrigin Widgets plugin versions = 2.8.2. Solution Update the WordPress Livemesh SiteOrigin Widgets plugin to the latest available version at least 2.8.3...

WordPress ConeBlog – WordPress Blog Widgets plugin <= 1.4.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress ConeBlog – WordPress Blog Widgets plugin versions = 1.4.5. Solution Update the WordPress ConeBlog – WordPress Blog Widgets plugin to the latest available version at least 1.4.6...

WordPress Livemesh SiteOrigin Widgets plugin <= 2.8.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Livemesh SiteOrigin Widgets plugin versions = 2.8.2. Solution Update the WordPress Livemesh SiteOrigin Widgets plugin to the latest available version at least 2.8.3...

WordPress Press Elements – Widgets for Elementor plugin <= 1.7.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Press Elements – Widgets for Elementor plugin versions = 1.7.2. Solution No patched version available...

WordPress Contact Widgets For Elementor plugin <= 1.0.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Contact Widgets For Elementor plugin versions = 1.0.5. Solution Update the WordPress Contact Widgets For Elementor plugin to the latest available version at least 1.0.6...

WordPress Widgets on Pages plugin <= 1.5.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Widgets on Pages plugin versions = 1.5.0. Solution Update the WordPress Widgets on Pages plugin to the latest available version at least 1.6.0...

WordPress Widgets on Pages and Posts plugin <= 1.4.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Widgets on Pages and Posts plugin versions = 1.4.0. Solution No patched version available...

WordPress Missing Widgets for Elementor plugin < 1.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Missing Widgets for Elementor plugin versions 1.1.0. Solution Update the WordPress Missing Widgets for Elementor plugin to the latest available version at least 1.1.0...

WordPress Widgets on Pages and Posts plugin <= 1.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Widgets on Pages and Posts plugin versions = 1.4.0. Solution No patched version available...

WordPress Ultimate Widgets Light plugin <= 1.5.9.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ultimate Widgets Light plugin versions = 1.5.9.4. Solution No patched version available...

WordPress Ultimate Widgets Light plugin <= 1.5.9.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Widgets Light plugin versions = 1.5.9.4. Solution No patched version available...

WordPress ConeBlog – WordPress Blog Widgets plugin <= 1.4.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress ConeBlog – WordPress Blog Widgets plugin versions = 1.4.5. Solution Update the WordPress ConeBlog – WordPress Blog Widgets plugin to the latest available version at least 1.4.6...

WordPress Widgets on Pages plugin <= 1.5.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Widgets on Pages plugin versions = 1.5.0. Solution Update the WordPress Widgets on Pages plugin to the latest available version at least 1.6.0...

WordPress "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)" plugin < 1.5.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Unlimited Elements For Elementor Free Widgets, Addons, Templates" plugin versions 1.5.3. Solution Update the WordPress "Unlimited Elements For Elementor Free Widgets, Addons, Templates" plugin to the...

WordPress Widgets for SiteOrigin plugin <= 1.4.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Widgets for SiteOrigin plugin versions = 1.4.8. Solution No patched version available...

WordPress Royal Elementor Addons (Header Footer Builder, Popups, Post Grid, Woocommerce Product Grid, Slider, Parallax Image, Free Elementor Widgets & Elementor Templates) plugin <= 1.3.32 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Royal Elementor Addons Header Footer Builder, Popups, Post Grid, Woocommerce Product Grid, Slider, Parallax Image, Free Elementor Widgets & Elementor Templates plugin versions = 1.3.32. Solution Update the WordPress Royal...

WordPress Dynamic Widgets plugin <= 1.5.16 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Dynamic Widgets plugin versions = 1.5.16. Solution Deactivate and delete. This plugin has been closed as of December 28, 2021 and is not available for download. This closure is temporary, pending a full review...

Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting

The plugin does not escape the prefix parameter before outputting it back in an attribute when using the termtree AJAX action available to any authenticated users, leading to a Reflected Cross-Site Scripting issue var form1 = document.getElementById'hack'; form1.submit;...

Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting

The plugin does not escape the prefix parameter before outputting it back in an attribute when using the termtree AJAX action available to any authenticated users, leading to a Reflected Cross-Site Scripting issue PoC...

ASB-A-184046278

In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permission due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for...