CVE-2024-5081

The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-5081

CVE-2024-5081 affects the WordPress plugin WP eMember , specifically versions prior to 10.7.0. The Red Hat advisory and NVD/NVD-derived entries state the vulnerability arises from lack of CSRF checks in some areas and missing sanitization/escaping, allowing a logged-in administrator to store Stor...

WordPress plugin wp-eMember 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-34418 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.7.0 Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS payloads...

CVE-2024-38776

Cross-Site Request Forgery CSRF vulnerability in Martin Gibson WP GoToWebinar allows Cross-Site Scripting XSS.This issue affects WP GoToWebinar: from n/a through 15.7...

CVE-2024-39659

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored XSS.This issue affects WP-PostRatings: from n/a through 1.91.1...

CVE-2024-39663

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through = 1.68.232...

CVE-2024-39659

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored XSS.This issue affects WP-PostRatings: from n/a through 1.91.1...

CVE-2024-39659 WordPress WP-PostRatings plugin <= 1.91.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored XSS.This issue affects WP-PostRatings: from n/a through 1.91.1...

CVE-2024-39659

CVE-2024-39659 affects WP-PostRatings up to version 1.91.1 and is a Stored XSS due to improper input neutralization during web page generation. Patch 1.91.2 fixes the issue; Patchstack and Red Hat/Wordfence references confirm the vulnerability type, affected versions, and patch status (Patched fo...

CVE-2024-39659 WordPress WP-PostRatings plugin <= 1.91.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored XSS.This issue affects WP-PostRatings: from n/a through 1.91.1...

CVE-2024-38770

Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.20...

CVE-2024-38770

CVE-2024-38770 describes an Improper Privilege Management issue in the WordPress plugin Backup and Staging by WP Time Capsule (versions up to 1.22.20). The vulnerability allows Privilege Escalation and Authentication Bypass, potentially enabling account takeover or unauthorized actions within aff...

CVE-2024-38770 WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.20 - Authentication Bypass and Privilege Escalation Vulnerability

Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.20...

WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc Patchstack Alliance in WordPress Plugin WP User Frontend versions = 4.0.7...

CVE-2024-6687

CVE-2024-6687 affects the WordPress plugin CTT Expresso para WooCommerce (versions ≤ 3.2.12). The flaw exposes sensitive data via /wp-content/uploads/cepw, where generated .pdf and log files containing sender/receiver names, phone numbers, physical addresses, and email addresses are publicly acce...

WordPress WP-PostRatings Plugin <= 1.91.1 is vulnerable to Cross Site Scripting (XSS)

Software WP-PostRatings Type Plugin Vulnerable versions = 1.91.1 Fixed in 1.91.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39659 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3a1b8a0a2985 Credits stealthcopter Required privilege...

CVE-2024-2508

The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savemenuitemicon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the 'mobmenuicon' post meta to...

CVE-2024-2508 WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification

The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savemenuitemicon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the 'mobmenuicon' post meta to...

CVE-2024-2508

CVE-2024-2508 affects the WordPress plugin WP Mobile Menu (versions up to 2.8.4.4). The vulnerability arises from a missing capability check in the save_menu_item_icon function, enabling unauthenticated attackers to modify data by adding the post meta key '_mobmenu_icon' with a crafted value on a...