CVE-2024-48038

Cross-Site Request Forgery CSRF vulnerability in tuxlog wp-Monalisa wp-monalisa.This issue affects wp-Monalisa: from n/a through = 6.4...

CVE-2024-48037

CVE-2024-48037 concerns the WordPress plugin Contact Form Widget (Contact Form Widget: Contact Query, Contact Page, Form Maker, Query Table) with versions 1.4.2 and earlier. The vulnerability is a CSRF flaw that could allow unauthorized state-changing requests from authenticated or possibly unaut...

CVE-2024-48037 WordPress Contact Form Widget plugin <= 1.4.2 - CSRF vulnerability

Cross-Site Request Forgery CSRF vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through = 1.4.2...

CVE-2024-48037 WordPress Contact Form Widget – Contact Query, Contact Page, Form Maker, Query Table plugin <= 1.4.2 - CSRF vulnerability

Cross-Site Request Forgery CSRF vulnerability in A WP Life Contact Form Widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through 1.4.2...

CVE-2024-48038

CVE-2024-48038 : A Cross-Site Request Forgery (CSRF) vulnerability affects the WordPress plugin wp-Monalisa, version 6.4 and earlier. Multiple sources (NVD, Patchstack, Red Hat, CNNVD, and CVE lists) confirm the issue and indicate a fix is available in version 6.5. The CVSS base score cited in th...

CVE-2024-48038 WordPress wp-Monalisa plugin <= 6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Hans Matzen wp-Monalisa allows Cross Site Request Forgery.This issue affects wp-Monalisa: from n/a through 6.4...

WordPress MAS Companies For WP Job Manager Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS)

Software MAS Companies For WP Job Manager Type Plugin Vulnerable versions = 1.0.13 Fixed in 1.0.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9206 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 18ca937f1193 Credits...

WordPress plugin The Ultimate WordPress Toolkit – WP Extended 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin The Ultimate WordPress Toolkit - WP...

PT-2024-16011 · WordPress · Wp Easy Post Types

Name of the Vulnerable Software and Affected Versions: WP Easy Post Types plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to a missing capability check on multiple functions, which allows authenticated attackers with subscriber-level access and above to...

WordPress plugin wp-Monalisa 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

WordPress WP REST API FNS Plugin <= 1.0.0 is vulnerable to Privilege Escalation

Software WP REST API FNS Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Privilege Escalation CVE CVE-2024-49328 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID b5035012904a Credits stealthcopter Required privilege...

CVE-2024-49593

CVE-2024-49593 affects the WordPress ecosystem via two plugins: Advanced Custom Fields (ACF) and Secure Custom Fields. The vulnerability is a stored XSS that can be triggered when editing a Field Group with the plugin editors, enabling execution of malicious payloads. Affected versions are ACF pr...

PT-2024-33374 · WordPress · Ahmeti Wp Timeline

Name of the Vulnerable Software and Affected Versions: Ahmeti Wp Timeline versions prior to 5.1 Description: A Cross-Site Request Forgery CSRF issue exists in Ahmet Imamoglu Ahmeti Wp Timeline, allowing Stored XSS. Recommendations: For versions prior to 5.1, update to a version that includes a fi...

CVE-2024-49593

In Advanced Custom Fields ACF before 6.3.9 and Secure Custom Fields before 6.3.6.3 plugins for WordPress, using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the fr...

CVE-2024-49266

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Thimo Grauerholz WP-Spreadplugin wp-spreadplugin allows Cross-Site Scripting XSS.This issue affects WP-Spreadplugin: from n/a through = 4.8.9...

CVE-2024-49266 WordPress WP-Spreadplugin plugin <= 4.8.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Thimo Grauerholz WP-Spreadplugin wp-spreadplugin allows Cross-Site Scripting XSS.This issue affects WP-Spreadplugin: from n/a through = 4.8.9...

CVE-2024-49266 WordPress WP-Spreadplugin plugin <= 4.8.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Thimo Grauerholz WP-Spreadplugin wp-spreadplugin allows Cross-Site Scripting XSS.This issue affects WP-Spreadplugin: from n/a through = 4.8.9...

CVE-2024-49226

Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN To WP Membership: from n/a through = 2.8.17...

CVE-2024-49226 WordPress TAKETIN To WP Membership plugin <= 2.8.17 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in taketin TAKETIN To WP Membership taketin-to-wp-membership allows Object Injection.This issue affects TAKETIN To WP Membership: from n/a through = 2.8.17...

CVE-2024-49226

CVE-2024-49226 affects TAKETIN To WP Membership (WordPress plugin) up to version 2.8.0. It is a PHP Object Injection (Deserialization of Untrusted Data) vulnerability that can enable arbitrary object injection. Impact is described as high in CVSS (8.8, HIGH) with potential for full compromise of ...