CVE-2023-49750

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Spoonthemes Couponis - Affiliate & Submitting Coupons WordPress Theme.This issue affects Couponis - Affiliate & Submitting Coupons WordPress Theme: from n/a before 2.2...

CVE-2023-49750

CVE-2023-49750 concerns the Couponis Demo WordPress vulnerability where an improper neutralization of input enables an SQL Injection. The issue affects the Couponis Demo/ Spoonthemes Couponis – Affiliate & Submitting Coupons Theme (WordPress) in versions before 2.2. Public sources (PATCHSTACK) ma...

PT-2023-31326 · WordPress · Spoonthemes Couponis

Name of the Vulnerable Software and Affected Versions: Spoonthemes Couponis - Affiliate & Submitting Coupons WordPress Theme versions prior to 2.2 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection'. This allows...

CVE-2023-49187

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4...

CVE-2023-49187

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spoonthemes Adifier - Classified Ads WordPress Theme allows Reflected XSS.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4...

CVE-2023-49187

CVE-2023-49187 is a reflected XSS in Spoonthemes Adifier – Classified Ads WordPress Theme (vulnerable before 3.1.4). The issue stems from improper neutralization of input during web page generation, enabling attacker-supplied data to be reflected in the page. Affected product: Adifier – Classifie...

PT-2023-31104 · WordPress · Adifier

Name of the Vulnerable Software and Affected Versions: Adifier - Classified Ads WordPress Theme versions prior to 3.1.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that...

CVE-2023-49827

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from...

CVE-2023-49827

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from...

CVE-2023-49827

CVE-2023-49827 affects the Soledad WordPress theme (multipurpose/Soledad) up to version 8.4.1, enabling Reflected XSS due to improper input handling in web page generation. The Red Hat and Patchstack entries corroborate the vulnerability and list 8.4.2 as the fixed version. Recommended remediatio...

WordPress Theme Editor Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload

Software Theme Editor Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.8 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2023-6091 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e6961ec7faba Credits Dateoljo of BoB 12th Required privilege...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4...

CVE-2023-36529

CVE-2023-36529 affects Favethemes Houzez - Real Estate WordPress Theme (Houzez CRM plugin)

PT-2023-25611 · Favethemes · Favethemes Houzez - Real Estate Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Favethemes Houzez - Real Estate WordPress Theme versions 1.3.4 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...

CVE-2023-3965

The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2023-3933 Your Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scripting

The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2023-3962 Winters <= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scripting

The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2020-36753

The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the savemetabox function. This makes it possible for unauthenticated attackers to save metabox data via a forged request...