CVE-2024-7626 WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read

The WP Delicious – Recipe Plugin for Food Bloggers formerly Delicious Recipes plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the saveeditprofiledetails function in all versions up to, and including, 1.6.9. This makes it possib...

WordPress WP Delicious plugin <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read vulnerability

Improper Path Validation to Authenticated Subscriber+ Arbitrary File Move and Read vulnerability discovered by Connor Billings in WordPress Plugin WP Delicious versions = 1.6.9...

PT-2024-38461 · WordPress · Wp Delicious – Recipe Plugin

Name of the Vulnerable Software and Affected Versions: The WP Delicious – Recipe Plugin for Food Bloggers plugin for WordPress versions up to, and including, 1.6.9 Description: The issue is related to insufficient file path validation in the save edit profile details function, allowing...

WordPress WP ULike Plugin < 4.7.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WP ULike Type Plugin Vulnerable versions 4.7.2.1 Fixed in 4.7.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6792 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fcd51aa95df1 Credits stealthcopter Required...

CVE-2024-6853

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-6855

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-6853

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-6859 WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode

The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-6852 WP MultiTasking <= 0.1.12 - Settings Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-6856

CVE-2024-6856 affects the WordPress plugin WP MultiTasking (versions up to 0.1.12). The root cause is a missing CSRF check when updating plugin settings, enabling a logged-in attacker to modify settings through a CSRF attack. Exploitation details are not provided beyond this description in the co...

CVE-2024-6853

The CVE CVE-2024-6853 concerns WP MultiTasking for WordPress, affected in versions

WordPress plugin WP MultiTasking 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-8292

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

CVE-2024-8317

CVE-2024-8317 concerns the WordPress plugin WP AdCenter – Ad Manager & Adsense Ads. The vulnerability is a stored cross-site scripting (XSS) via the ad_alignment attribute affecting all versions up to and including 2.5.6. Exploitation requires authenticated access at Contributor level or higher, ...

CVE-2024-8292

CVE-2024-8292 affects WP-Recall – Registration, Profile, Commerce & More for WordPress (versions

CVE-2024-8292 WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new order creation. This makes it possible for...

CVE-2024-6792

The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page...

CVE-2024-6792 WP ULike < 4.7.2.1 - Subscriber+ Stored-XSS

The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page...

WordPress WP-Recall Plugin <= 16.26.8 is vulnerable to Insecure Direct Object References (IDOR)

Software WP-Recall Type Plugin Vulnerable versions = 16.26.8 Fixed in 16.26.9 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-8292 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 49cff2ea1861 Credits wesley wcraft...

WordPress WP AdCenter Plugin <= 2.5.6 is vulnerable to Cross Site Scripting (XSS)

Software WP AdCenter Type Plugin Vulnerable versions = 2.5.6 Fixed in 2.5.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8317 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cf77f095bc05 Credits Francesco Carlucci Required...