WordPress WP EasyPay Plugin <= 4.2.3 is vulnerable to Broken Access Control

Software WP EasyPay Type Plugin Vulnerable versions = 4.2.3 Fixed in 4.2.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5861 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 60a90782a604 Credits Lucio Sá Required privilege...

WordPress WP ULike Plugin < 4.7.1 is vulnerable to Cross Site Scripting (XSS)

Software WP ULike Type Plugin Vulnerable versions 4.7.1 Fixed in 4.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6094 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2b5286cbd123 Credits Dmitrii Ignatyev Required privile...

WordPress AMP for WP Plugin <= 1.0.96.1 is vulnerable to Cross Site Scripting (XSS)

Software AMP for WP Type Plugin Vulnerable versions = 1.0.96.1 Fixed in 1.0.97 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6896 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0ff929ad7ead Credits wesley wcraft Required...

Magento Sites Targeted with Sneaky Credit Card Skimmer via Swap Files

Threat actors have been observed using swap files in compromised websites to conceal a persistent credit card skimmer and harvest payment information. The sneaky technique, observed by Sucuri on a Magento e-commerce site's checkout page, allowed the malware to survive multiple cleanup attempts, t...

CVE-2024-6420

The CVE-2024-6420 entry concerns the WordPress plugin Hide My WP Ghost before 5.2.02. The root cause is that redirects to the login page via WordPress auth_redirect are not blocked by the plugin, allowing an unauthenticated user to access the hidden login page. Impact is unauthenticated disclosur...

WordPress plugin Hide My WP Ghost 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress Hide My WP Ghost Plugin < 5.2.02 is vulnerable to Bypass Vulnerability

Software Hide My WP Ghost Type Plugin Vulnerable versions 5.2.02 Fixed in 5.2.02 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-6420 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID c358fc787ef1 Credits Juan Pablo Gomez Postigo Required...

CVE-2024-38759

Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2...

CVE-2024-38759

CVE-2024-38759 is a Deserialization of Untrusted Data vulnerability in the WordPress plugin WP MEDIA SAS Search & Replace (Search & Replace) affecting versions from n/a up to and including 3.2.2. The root cause is deserialization of untrusted data leading to potential compromise. The connected do...

CVE-2024-37101

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in AF themes WP Post Author allows Stored XSS.This issue affects WP Post Author: from n/a through 3.6.7...

CVE-2024-37101

CVE-2024-37101: An stored XSS in the WordPress plugin WP Post Author (Enhance Your Posts with Author Box, Social Links, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder) affecting WP Post Author versions from n/a up to 3.6.7. Description indicates Improp...

CVE-2024-37416

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002...

CVE-2024-37416

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002...

CVE-2024-37261

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.This issue affects WP-Lister Lite for Amazon: from n/a through = 2.6.16...

CVE-2024-37259

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 2.4.7...

CVE-2024-37259

CVE-2024-37259 affects The Ultimate WordPress Toolkit – WP Extended (WP Extended) plugin. Public sources describe Cross-Site Scripting (XSS) in WP Extended up to version 2.4.7, with varying classifications across sources: the NVD entry cites Reflected XSS, while other connected templates discuss ...

CVE-2024-37259 WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through = 2.4.7...

CVE-2024-37259 WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through = 2.4.7...

CVE-2024-37261 WordPress WP-Lister Lite for Amazon plugin <= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.This issue affects WP-Lister Lite for Amazon: from n/a through = 2.6.16...

CVE-2024-37261 WordPress WP-Lister Lite for Amazon plugin <= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Lab WP-Lister Lite for Amazon allows Reflected XSS.This issue affects WP-Lister Lite for Amazon: from n/a through 2.6.16...