6480 matches found
CVE-2024-11194
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtclimportsettings' function in all versions up to, and including, 3.1.15.1. This...
CVE-2024-11038
The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpbpcffirecontactform AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to...
WordPress plugin Surbma | Font Awesome 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-8856 Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticat...
EUVD-2024-32866
The ConvertCalculator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'type' parameters in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-10897
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the installetlmsdependencyplugin function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-lev...
PT-2024-15975 · WordPress · Convertcalculator
Name of the Vulnerable Software and Affected Versions: ConvertCalculator for WordPress plugin versions up to, and including, 1.1.1 Description: The issue is related to Stored Cross-Site Scripting via the id and type parameters due to insufficient input sanitization and output escaping. This allow...
PT-2024-16062 · WordPress · Simple File List
Name of the Vulnerable Software and Affected Versions: Simple File List WordPress plugin versions prior to 6.1.13 Description: The issue is related to a Reflected Cross-Site Scripting flaw. It occurs because the plugin does not properly sanitise and escape a generated URL before outputting it bac...
WordPress Really Simple SSL Plugin Authentication Bypass to RCE
This module exploits an authentication bypass vulnerability in the WordPress Really Simple SSL plugin versions 9.0.0 to 9.1.1.1. The vulnerability allows bypassing two-factor authentication 2FA and uploading a plugin to achieve remote code execution RCE. Note: For the system to be vulnerable, 2FA...
EUVD-2024-33676
The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletetmpuploadedfile function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files o...
PT-2024-16374 · WordPress · Chartify
Name of the Vulnerable Software and Affected Versions: The Chartify – WordPress Chart Plugin versions up to, and including, 2.9.5 Description: The issue is related to Local File Inclusion, allowing unauthenticated attackers to include and execute arbitrary files on the server via the source...
CVE-2024-10284
The CE21 Suite plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.2.0. This is due to hardcoded encryption key in the 'ce21authenticationphrase' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site,...
CVE-2024-10779 Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure
The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'cetemplate' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...
CVE-2024-10285 CE21 Suite <= 2.2.0 - JWT Token Disclosure
The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token...
PT-2024-38737 · WordPress · The Events Calendar
Name of the Vulnerable Software and Affected Versions: Registrations for the Events Calendar WordPress plugin versions prior to 2.12.4 Description: The issue concerns a failure to sanitise and escape certain parameters when accepting event registrations, potentially allowing unauthenticated users...
CVE-2024-51661 WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through = 3.19...
WordPress FraudLabs Pro SMS Verification plugin <= 1.10.1 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin FraudLabs Pro SMS Verification versions = 1.10.1...
PT-2024-8881 · WordPress · Spam Protection
Name of the Vulnerable Software and Affected Versions: Spam protection, Anti-Spam, FireWall by CleanTalk for WordPress versions up to and including 6.44 Description: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is susceptible to unauthorized arbitrary plugin...
WordPress Simple Business Manager plugin <= 4.6.7.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by CTRL - Chance Patchstack Alliance in WordPress Plugin Simple Business Manager versions = 4.6.7.4...
