WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin WP User Frontend versions = 4.0.7...

CVE-2024-6687

CVE-2024-6687 affects the WordPress plugin CTT Expresso para WooCommerce (versions ≤ 3.2.12). The flaw exposes sensitive data via /wp-content/uploads/cepw, where generated .pdf and log files containing sender/receiver names, phone numbers, physical addresses, and email addresses are publicly acce...

WordPress WP-PostRatings Plugin <= 1.91.1 is vulnerable to Cross Site Scripting (XSS)

Software WP-PostRatings Type Plugin Vulnerable versions = 1.91.1 Fixed in 1.91.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39659 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3a1b8a0a2985 Credits stealthcopter Required privilege...

CVE-2024-2508

The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savemenuitemicon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the 'mobmenuicon' post meta to...

CVE-2024-2508 WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification

The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savemenuitemicon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the 'mobmenuicon' post meta to...

CVE-2024-2508

CVE-2024-2508 affects the WordPress plugin WP Mobile Menu (versions up to 2.8.4.4). The vulnerability arises from a missing capability check in the save_menu_item_icon function, enabling unauthenticated attackers to modify data by adding the post meta key '_mobmenu_icon' with a crafted value on a...

CVE-2024-5809

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users...

CVE-2024-5809 WP Ajax Contact Form <= 2.2.2 - Reflected Cross-Site Scripting

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users...

CVE-2024-5809

CVE-2024-5809 affects the WordPress plugin WP Ajax Contact Form (versions up to and including 2.2.2). The issue is a Reflected Cross-Site Scripting caused by not sanitising/escaping a parameter before echoing it in the page, potentially targeting admin users. Public details confirm the vulnerabil...

CVE-2024-5808

CVE-2024-5808 affects the WP Ajax Contact Form WordPress plugin up to version 2.2.2. The vulnerability is due to missing CSRF protection when deleting emails from the email list, potentially allowing a logged-in admin to be coerced into performing deletion via CSRF. Technical details across conne...

PT-2024-37171 · WordPress · Wp Ajax Contact Form

Name of the Vulnerable Software and Affected Versions: WP Ajax Contact Form WordPress plugin versions 2.2.2 and earlier Description: The issue concerns a lack of CSRF check when deleting emails from the email list. This could allow attackers to make a logged-in admin perform such an action via a...

WordPress WP Ajax Contact Form Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Ajax Contact Form Type Plugin Vulnerable versions = 2.2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-5808 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 1a37a94a7ce4 Credits Bob Matyas Requir...

PT-2024-37172 · WordPress · Wp Ajax Contact Form

Name of the Vulnerable Software and Affected Versions: WP Ajax Contact Form WordPress plugin versions 2.2.2 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in...

WordPress WP Ajax Contact Form Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Ajax Contact Form Type Plugin Vulnerable versions = 2.2.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5809 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d1bf246662eb Credits Bob Matyas...

CVE-2024-5285 WP Affiliate Platform < 6.5.2 - Affiliate Deletion via CSRF

The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack...

WordPress Master Currency WP plugin <= 1.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via Currency Converter Form Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Currency Converter Form Shortcode vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin Master Currency WP versions = 1.1.61...

WordPress Master Currency WP Plugin <= 1.1.61 is vulnerable to Cross Site Scripting (XSS)

Software Master Currency WP Type Plugin Vulnerable versions = 1.1.61 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6634 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 595acc86d3da Credits Artem Polynko Artem...

WordPress plugin wp-affiliate-platform 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-6703

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ and 'btntxt' parameters in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output...

CVE-2024-6521

CVE-2024-6521 affects the WordPress plugin Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder. All versions up to 5.1.19 are vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Exploitation requires Administrator...