WordPress plugin Beaver Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-3806

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the ‘portoajaxposts’ function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in...

CVE-2024-3940 reCAPTCHA Jetpack <= 0.2.2 - Settings Update via CSRF

The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-3974 BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in versions up to, and including, 12.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions...

CVE-2024-2661 Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Authenticated (Subscriber+) SQL Injection

The Barcode Scanner and Inventory manager. POS Point of Sale – scan barcodes & create orders with barcode reader. plugin for WordPress is vulnerable to blind SQL Injection via the ‘currentIds’ parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied...

WordPress plugin ACF On-The-Go 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-18213 · WordPress · Print Labels With Barcodes

Name of the Vulnerable Software and Affected Versions: The Print Labels with Barcodes plugin for WordPress versions up to, and including, 3.4.6 Description: The issue allows for unauthorized access, modification, and loss of data due to an improper capability check on 42 separate AJAX functions...

PT-2024-18119 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.15.5 Description: The issue is related to Stored Cross-Site Scripting via the HTML Element due to insufficient input sanitization and output...

PT-2024-26178 · WordPress · Popup Box

Name of the Vulnerable Software and Affected Versions: The Popup Box WordPress plugin versions prior to 2.2.7 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting popups v...

PT-2024-26157 · WordPress · Sticky Buttons

Name of the Vulnerable Software and Affected Versions: The Sticky Buttons WordPress plugin versions prior to 3.2.4 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

PT-2024-23612 · WordPress · Mm-Email2Image

Name of the Vulnerable Software and Affected Versions: MM-email2image WordPress plugin versions 0.2.5 and earlier Description: The issue is related to the lack of CSRF checks in some places and missing sanitization as well as escaping in the MM-email2image WordPress plugin. This could allow...

PT-2024-3040 · WordPress · Forminator

Name of the Vulnerable Software and Affected Versions: Forminator versions prior to 1.29.0 Description: The issue is related to an unrestricted upload of files with dangerous types in the Forminator plugin for WordPress. This could allow a remote attacker to upload arbitrary files to the server,...

PT-2024-15877 · WordPress · Coreactivity

Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging plugin for WordPress versions prior to 2.1 Description: The issue allows users to spoof IP addresses by providing an arbitrary value via headers such as X-FORWARDED, which are used to log IP addresses of request...

PT-2024-18278 · WordPress · Nps Computy Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: NPS computy WordPress plugin versions 2.7.5 and earlier Description: The issue concerns the lack of CSRF checks in certain areas of the plugin, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks...

WordPress Plugin Shortcodes Ultimate 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress 6.1.x < 6.1.6 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a Cross-Site Scripting XSS vulnerability affecting the avatar block type. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

WordPress 6.5.x < 6.5.2 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a Cross-Site Scripting XSS vulnerability affecting the avatar block type. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

WordPress 6.2.x < 6.2.5 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a Cross-Site Scripting XSS vulnerability affecting the avatar block type. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 1, 2024 to April 7, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 193 vulnerabilities disclosed in 154 WordPres...

WordPress Subscribe2 plugin <= 10.42 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Subscribe2 versions = 10.42...