PT-2024-14436

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall versions 5.2.4 and earlier Description The issue affects the All In One WP Security & Firewall plugin, allowing exposure of sensitive information to unauthorized actors due to improperly constrained access to...

CVE-2024-4392: Improper Neutralization of Input During Web Page Generation

The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-30468

Cross-Site Request Forgery CSRF vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6...

CVE-2024-30468

All In One WP Security & Firewall (AIOS) for WordPress is affected by a Cross-Site Request Forgery (CSRF) vulnerability in versions up to 5.2.6, with fix released in 5.2.7. The issue can be triggered by unauthenticated attackers exploiting CSRF to manipulate actions triggered by site administrato...

CVE-2024-30468: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6...

CVE-2023-45050

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1...

CVE-2023-45050

CVE-2023-45050 is a Cross-site Scripting (Stored XSS) in Automattic Jetpack – WP Security, Backup, Speed, & Growth (Jetpack) up to version 12.8-a.1. Root cause: improper neutralization of input during web page generation. Affected product: Jetpack plugin for WordPress. Public fix: version 12.8-a....

CVE-2023-45050: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1...

PT-2023-29370

Name of the Vulnerable Software and Affected Versions Jetpack – WP Security, Backup, Speed, & Growth versions n/a through 12.8-a.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This mea...

Cross site request forgery (csrf)

The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a...

CVE-2021-4386

The CVE refers to the WP Security Question WordPress plugin, with CSRF in versions up to and including 1.0.5 caused by missing or incorrect nonce validation in the save() function. This allows unauthenticated attackers to modify plugin settings through forged requests if a site administrator is t...

CVE-2021-4386: Cross-Site Request Forgery (CSRF)

The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a...

CVE-2022-4346 All In One WP Security & Firewall < 5.1.3 - Configuration Leak

The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...

CVE-2022-4346 All In One WP Security & Firewall < 5.1.3 - Configuration Leak

The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...

All In One WP Security & Firewall < 5.1.3 - Configuration Leak

The plugin leaked settings of the plugin publicly, including the used email address. PoC Config leak in previous versions: "aiowpsremovewpgeneratormetainfo" filetype:txt https://www.google.com/search?q=%22aiowpsremovewpgeneratormetainfo%22+filetype%3Atxt Search for aiowpsemailaddress...

WordPress core <= 6.0.2 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability in the Search block discovered by Alex Concha WP Security team in WordPress core versions = 6.0.2. Solution Update the WordPress to the latest available version at least 6.0.3...

CVE-2021-25102

The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirectto parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redire...

PT-2022-9657

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall WordPress plugin versions prior to 4.4.11 Description The issue arises from the lack of validation, sanitization, and escaping of the redirect to parameter, which can lead to Arbitrary Redirect and Cross-Site...

CVE-2021-25102: Improper Neutralization of Input During Web Page Generation

The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirectto parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redire...

WordPress All In One WP Security plugin <= 4.4.10 - Authenticated Arbitrary Redirect / Reflected XSS vulnerability

Authenticated Arbitrary Redirect / Reflected XSS vulnerability discovered by JrXnm in WordPress All In One WP Security plugin versions = 4.4.10. Solution Update the WordPress All In One WP Security plugin to the latest available version at least 4.4.11...