CVE-2024-54308 WordPress Cryptocurrency Price Widget plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CurrencyRate.today Cryptocurrency Price Widget allows Stored XSS.This issue affects Cryptocurrency Price Widget: from n/a through 1.2.3...

CVE-2024-54298 WordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerability

Missing Authorization vulnerability in sminozzi Car Dealer cardealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Dealer: from n/a through = 4.46...

CVE-2024-54239 WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in dugudlabs Eyewear prescription form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through 4.0.18...

CVE-2023-44142 WordPress Inactive Logout plugin <= 3.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Deepen Bajracharya Inactive Logout inactive-logout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Inactive Logout: from n/a through = 3.2.2...

CVE-2023-41952 WordPress Fluent Forms plugin <= 5.0.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 5.0.8...

CVE-2023-32520 WordPress WCP Contact Form plugin <= 3.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebCodin WCP Contact Form wcp-contact-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through = 3.1.0...

CVE-2022-46846 WordPress Trending/Popular Post Slider and Widget plugin <= 1.5.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Trending/Popular Post Slider and Widget wp-trending-post-slider-and-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trending/Popular Post Slider and Widget: from n/a through...

CVE-2022-46795 WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 4.7.2 - CSRF Plugin Settings Reset vulnerability

Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through = 4.7.2...

CVE-2024-9290

CVE-2024-9290 affects the WordPress plugin Super Backup & Clone - Migrate for WordPress. The issue is an unauthenticated arbitrary file upload due to missing file-type validation and a missing capability check in ibk_restore_migrate_check(), present in all versions up to 2.3.3 according to the in...

CVE-2024-12465

CVE-2024-12465 (Property Hive Stamp Duty Calculator for WordPress) is a stored XSS flaw in the stamp_duty_calculator_scotland shortcode present in all versions up to 1.0.22. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes, ena...

CVE-2024-12417

CVE-2024-12417 concerns the Simple Link Directory plugin for WordPress. The issue is arbitrary shortcode execution in versions up to and including 8.4.0, caused by a lack of proper validation before executing do_shortcode, enabling unauthenticated attackers to run arbitrary shortcodes. The Red Ha...

CVE-2024-12421

The Coupon Affiliates – Affiliate Plugin for WooCommerce for WordPress is affected by CVE-2024-12421, enabling unauthenticated arbitrary shortcode execution via an unchecked value in do_shortcode (and also Reflected XSS). The Cross-Site Scripting was patched in 5.16.7.1, while the arbitrary short...

CVE-2024-12579

The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service ReDoS in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can...

CVE-2024-12574

CVE-2024-12574 concerns the WordPress plugin SVG Shortcode. The description in the initial document states it is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to and including 1.0.1, caused by insufficient input sanitization and output escaping. Connected docum...

CVE-2024-11767

CVE-2024-11767 affects the NewsmanApp WordPress plugin. The vulnerability is a Stored Cross-Site Scripting in the plugin’s newsman_subscribe_widget shortcode, present in all versions up to 2.7.6. Exploitation requires authenticated access at contributor level or higher, allowing an attacker to in...

CVE-2024-12572

The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious...

CVE-2019-25221 Responsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection

The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2024-12300

CVE-2024-12300 (AR for WordPress) is an unauthorized double extension file upload vulnerability in the AR for WordPress WordPress plugin, caused by a missing capability check in set_ar_featured_image(). The issue affects all versions up to and including 7.3, enabling unauthenticated attackers to ...

CVE-2024-12572 Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious...

WordPress plugin eRoom – Zoom Meetings & Webinar 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...