16683 matches found
CVE-2024-44030
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Absolute Path Traversal.This issue affects Checkout Mestres WP: from n/a through = 8.6...
CVE-2024-44030 WordPress Checkout Mestres WP plugin <= 8.6 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Absolute Path Traversal.This issue affects Checkout Mestres WP: from n/a through = 8.6...
CVE-2024-44030
CVE-2024-44030: Local File Inclusion (path traversal) in Checkout Mestres WP (Mestres do WP Checkout) plugins allows PHP local file inclusion. Affected: Checkout Mestres WP versions n/a through 8.6. Root cause: Improper limitation of a pathname to a restricted directory. Impact: Confidentiality, ...
CVE-2024-7855
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the updatereview function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload...
WordPress plugin Checkout Mestres WP 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
WordPress WP Hotel Booking Plugin <= 2.1.2 is vulnerable to Arbitrary File Upload
Software WP Hotel Booking Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7855 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 3cc7b05576d0 Credits Truoc Phan Required privilege Subscribe...
8,000 WordPress Sites affected by Arbitrary File Upload Vulnerability in WP Hotel Booking WordPress Plugin
📢 Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024 , r esearche...
CVE-2024-9209
The WP Search Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2024-9018
CVE-2024-9018 affects WP Easy Gallery – WordPress Gallery Plugin. The vulnerability is a time-based SQL Injection via the key parameter in all versions up to and including 4.8.5, caused by insufficient escaping and inadequate preparation of the SQL query. Exploitation requires authenticated acces...
CVE-2024-9018 WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter
The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
WordPress WP Easy Gallery plugin <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter vulnerability
Authenticated Contributor+ SQL Injection via key Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Easy Gallery versions = 4.8.5...
WordPress WP Search Analytics Plugin <= 1.4.10 is vulnerable to Cross Site Scripting (XSS)
Software WP Search Analytics Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9209 Patch priority Medium CVSS severity Medium 7.1 Developer Cornel Raiu PSID 95b75262f4d2 Credits vgo0 Required...
WordPress plugin WP Search Analytics 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...
PT-2024-38632 · WordPress · Wp Hotel Booking
Name of the Vulnerable Software and Affected Versions: WP Hotel Booking plugin for WordPress versions up to, and including, 2.1.2 Description: The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update review function. This...
WordPress WP Travel Gutenberg Blocks Plugin <= 3.6.0 is vulnerable to Cross Site Scripting (XSS)
Software WP Travel Gutenberg Blocks Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.7.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47627 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 141b5dd3b08f Credits João Pedro S Alcântara...
WordPress WP-WebAuthn Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)
Software WP-WebAuthn Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47650 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a5c171e8acd4 Credits theviper17 Required privilege Contributor...
WordPress WP Compress – Image Optimizer [All-In-One] Plugin <= 6.20.13 is vulnerable to Cross Site Scripting (XSS)
Software WP Compress – Image Optimizer All-In-One Type Plugin Vulnerable versions = 6.20.13 Fixed in 6.21.01 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47384 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 43c181546686 Credits Le...
WordPress WP-Lister Lite for eBay Plugin <= 3.6.3 is vulnerable to Cross Site Scripting (XSS)
Software WP-Lister Lite for eBay Type Plugin Vulnerable versions = 3.6.3 Fixed in 3.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47380 Patch priority Medium CVSS severity Medium 7.1 Developer WP Lab PSID 048f66c74b94 Credits Le Ngoc Anh Required privilege...
WordPress WP MyLinks Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)
Software WP MyLinks Type Plugin Vulnerable versions = 1.0.6 Fixed in 1.0.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47371 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a980ce4c70f6 Credits SOPROBRO Required privilege Editor Publishe...
