49933 matches found
WordPress Custom TinyMCE Shortcode Button plugin <= 1.1 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Custom TinyMCE Shortcode Button plugin versions = 1.1. Solution Deactivate and delete. This plugin has been closed as of April 4, 2022 and is not available for download. This closure is temporary, pending a full revi...
WordPress WPvivid plugin <= 0.9.70 - Arbitrary File Read vulnerability
Arbitrary File Read vulnerability discovered by Muhammad Daffa Patchstack Alliance in WordPress WPvivid plugin versions = 0.9.70. Solution Update the WordPress WPvivid plugin to the latest available version at least 0.9.71...
WordPress Advanced Custom Fields plugin <= 5.12 - Database Information Access vulnerability
Database Information Access vulnerability was discovered by Keitaro Yamazaki Ierae Security Inc in the WordPress Advanced Custom Fields plugin versions = 5.12. Solution Update the WordPress Advanced Custom Fields plugin to the latest available version at least 5.12.1...
WordPress Nimble Page Builder plugin < 3.2.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress Nimble Page Builder plugin versions 3.2.2. Solution Update the WordPress Nimble Page Builder plugin to the latest available version at least 3.2.3...
WordPress Export All URLs plugin <= 4.2 - Private/Draft Post/Page Title Disclosure via Cross-Site Request Forgery (CSRF) vulnerability
Private/Draft Post/Page Title Disclosure via Cross-Site Request Forgery CSRF vulnerability discovered by Asif Nawaz Minhas in WordPress Export All URLs plugin versions = 4.2. Solution Update the WordPress Export All URLs plugin to the latest available version at least 4.3...
WordPress GTranslate plugin <= 2.9.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Account Takeover
Cross-Site Request Forgery CSRF vulnerability leading to Account Takeover discovered in WordPress GTranslate plugin versions = 2.9.8. Solution Update the WordPress GTranslate plugin to the latest available version at least 2.9.9...
WordPress TI WooCommerce Wishlist plugin <= 1.40.0 - Unauthenticated Blind SQL Injection (SQLi) vulnerability
Unauthenticated Blind SQL Injection SQLi vulnerability discovered by Krzysztof ZajÄ…c in WordPress TI WooCommerce Wishlist plugin versions = 1.40.0. Solution Update the WordPress TI WooCommerce Wishlist plugin to the latest available version at least 1.40.1...
WordPress Logo Showcase with Slick Slider plugin <= 2.0 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF vulnerability
Arbitrary Media Title/Description/Alt Text/URL Update via CSRF vulnerability discovered by apple502j in WordPress Logo Showcase with Slick Slider plugin versions = 2.0. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 2.0.1...
WordPress GiveWP plugin <= 2.17.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS via Donation Forms Dashboard vulnerability discovered by JrXnm in WordPress GiveWP plugin versions = 2.17.2. Solution Update the WordPress GiveWP plugin to the latest available version at least 2.17.3...
WordPress PPOM for WooCommerce plugin <= 23.9 - Settings Update vulnerability leading to Stored Cross-Site Scripting (XSS)
Settings Update vulnerability leading to Stored Cross-Site Scripting XSS discovered by Krzysztof ZajÄ…c in WordPress PPOM for WooCommerce plugin versions = 23.9. Solution Update the WordPress PPOM for WooCommerce plugin to the latest available version at least 24.0...
WordPress Customize Login Image plugin <= 3.5.2 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Cyber Security Works Pvt. Ltd in WordPress Customize Login Image plugin versions = 3.5.2. Solution Update the WordPress Customize Login Image plugin to the latest available version at least 3.5.3...
WordPress Modern Events Calendar Lite plugin <= 6.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress Modern Events Calendar Lite plugin versions = 6.1.0. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 6.1.5...
WordPress SendGrid plugin <= 1.11.8 - Authenticated Authorization Bypass vulnerability
Authenticated Authorization Bypass vulnerability discovered by Prashant Baldha in WordPress SendGrid plugin versions = 1.11.8. Solution This plugin has been closed as of July 13, 2021 and is not available for download. This closure is permanent...
WordPress Newspaper premium theme <= 10.4 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Truoc Phan in WordPress Newspaper premium theme versions = 10.4. Solution Update the WordPress Newspaper premium theme to the latest available version at least 11,...
WordPress Yes/No Chart plugin <= 1.0.11 - Authenticated Blind SQL Injection (SQLi) vulnerability
Authenticated Blind SQL Injection SQLi vulnerability discovered by Apple502j in WordPress Yes/No Chart plugin versions = 1.0.11. Solution Update the WordPress Yes/No Chart plugin to the latest available version at least 1.0.12...
WordPress JNews premium theme <= 8.0.5 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Truoc Phan in WordPress JNews premium theme versions = 8.0.5. Solution Update the WordPress JNews premium theme to the latest available version at least 8.0.6...
WordPress LMS by LifterLMS plugin <= 4.21.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Amirmuhammad Vakili in WordPress LMS by LifterLMS plugin versions = 4.21.0. Solution Update the WordPress LMS by LifterLMS plugin to the latest available version at least 4.21.1...
WordPress WP Fastest Cache plugin <= 0.9.1.6 - Authenticated Arbitrary File Deletion via Path Traversal vulnerability
Authenticated Arbitrary File Deletion via Path Traversal vulnerability discovered by Gen Sato in WordPress WP Fastest Cache plugin versions = 0.9.1.6. Solution Update the WordPress WP Fastest Cache plugin to the latest available version at least 0.9.1.7...
WordPress Facebook for WordPress plugin <= 3.0.3 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Facebook for WordPress plugin versions 3.0.0 – 3.0.3. Solution Update the WordPress Facebook for WordPress plugin to the latest available version at least 3.0.4...
WordPress Mapplic premium plugin <= 6.1 - Stored Cross-Site Scripting (XSS) Injection via Server-Side Request Forgery (SSRF) vulnerability
Stored Cross-Site Scripting XSS Injection via Server-Side Request Forgery SSRF vulnerability discovered by Eagle Eye in WordPress Mapplic premium plugin versions = 6.1. Solution Update the WordPress Mapplic premium plugin to the latest available version at least 7.0...
WordPress Welcart e-Commerce plugin <= 1.9.35 - Authenticated PHP Object Injection vulnerability
Authenticated PHP Object Injection vulnerability found by Ramuel Gall in WordPress Welcart e-Commerce plugin versions = 1.9.35. Solution Update the WordPress Welcart e-Commerce plugin to the latest available version at least 1.9.36...
WordPress Customizr theme <= 4.3.2 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress Customizr theme versions = 4.3.2. Solution Update the WordPress Customizr theme to the latest available version at least 4.3.3...
WordPress YITH WooCommerce Multi Vendor plugin <=3.4.0 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability
Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Multi Vendor plugin versions =3.4.0. Solution Update the WordPress YITH WooCommerce Multi Vendor plugin to the latest available version at least 3.4.1...
WordPress Baggage Freight Shipping Australia plugin 0.1.0 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability found by Kaimi in WordPress Baggage Freight Shipping Australia plugin version 0.1.0. Solution 08.01.2019 - we were unable to find a patched version of this plugin...
WordPress Legacy Theme <= 4.2.3 - XSS
This vulnerability exists in the Legacy theme preview implementation in wp-includes/theme.php. It allows an attacker to inject arbitrary HTML or web script via a crafted string. Solution Update the theme...
WordPress <= 4.2.3 - XSS #2
This vulnerability exists in the WPNavMenuWidget class in wp-includes/default-widgets.php in the "form" function. It allows remote attackers to inject arbitrary web script or HTML via a widget title. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-2-3-xss Solution...
WordPress XCloner Plugin <= 3.1.2 - Multiple vulnerabilities
This XCloner plugin is prone to an authenticated command execution and XSS. Because of multiple vulnerabilities in cloner.functions.php, remote authenticated users can execute arbitrary commands via a file containing filenames with shell metacharacters. Solution Update the plugin...
WordPress XCloner Plugin <= 3.1.2 - Static Code Injection
Because of this vulnerability remote authenticated users can inject arbitrary PHP code into the language files via a Translation LMFRONT field for a language. Solution Update the plugin...
WordPress Ninja Forms Plugin <= 2.8.8 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "ninjaformsfield1" parameter in a ninjaformsajaxsubmit action to wp-admin/admin-ajax.php. Also, multiple cross site scripting vulnerabilities allow the administrators to inject arbitrary web script or...
WordPress Login Rebuilder Plugin <= 1.1.9 - CSRF
Because of this vulnerability, the attackers can hijack the authentication of arbitrary users. Solution Update the plugin...
WordPress prettyPhoto Plugin <= 3.1.4 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via a crafted PATHINTO to the default URI. Solution Update the plugin...
WordPress Sentinel Plugin <= 1.0.0 - SQL iNJECTION
Because of this vulnerability, the attackers can execute arbitrary SQL commands via unspecified vectors. Solution Update the plugin...
WordPress Better WP Security Plugin <= 3.2.4 - XSS
Because of this vulnerability in inc/admin/content.php, the attackers can inject arbitrary web script or HTML via the HTTPUSERAGENT header. Solution Update the plugin...
WordPress <= 2.0- Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "userlogin" parameter. Solution Update WordPress...
WordPress Pool Theme <= 1.0.7 - XSS
Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML via the PATHINFO. Solution Update the theme...
WordPress <= 2.0.6 - Full Path disclosure
Because of this vulnerability, the attackers can obtain sensitive information via an invalid m parameter. Solution Update the WordPress to the latest available version at least 2.0.7...
WordPress <= 1.2 - Remote Code Execution
Because of this vulnerability in The httpsrequest function in Snoopy, the attackers can execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, that is not properly handled by the fetch function. Solution Update the WordPress to the latest available versi...
WordPress User Registration & Membership plugin < 5.2.5 - Subscriber+ Pending Email Change Cancellation vulnerability
Subscriber+ Pending Email Change Cancellation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.5...
WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability
Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...
WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by hackthesoul in WordPress Plugin SupportCandy versions = 3.5.1...
WordPress Montonio for WooCommerce plugin <= 10.1.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Niv Kochan in WordPress Plugin Montonio for WooCommerce versions = 10.1.2...
NPM: Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
NPM: Better Auth: OAuth callback accepts mismatched state when cookie-backed state storage is used without PKCE vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.2...
NPM: FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment
NPM: FlowiseAI has Mass Assignment in Tool Update Endpoint that Allows Cross-Workspace Resource Reassignment vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...
WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Alexis Lafontaine in WordPress Plugin Royal MCP versions = 1.4.2...
WordPress Map My Locations plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Map My Locations versions = 1.1...
WordPress Popup Maker plugin <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via popupID Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Popup Maker versions = 1.20.4...
WordPress LearnPress Plugin <= 4.2.7 is vulnerable to SQL Injection
Software LearnPress Type Plugin Vulnerable versions = 4.2.7 Fixed in 4.2.7.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8522 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 13b3ec9c4ec2 Credits abrahack Required privilege Unauthenticated Publish...
WordPress Z Y N I T H Plugin <= 7.4.9 is vulnerable to Settings Change
Software Z Y N I T H Type Plugin Vulnerable versions = 7.4.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43940 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b82e28b179e8 Credits Dave Jong Patchstack Required...
WordPress TI WooCommerce Wishlist Plugin <= 2.8.2 is vulnerable to SQL Injection
Software TI WooCommerce Wishlist Type Plugin Vulnerable versions = 2.8.2 Fixed in 2.9.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43917 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 55f8b0990265 Credits Rafie Muhammad Patchstack Required...
WordPress WS Form LITE Plugin <= 1.9.217 is vulnerable to CSV Injection
Software WS Form LITE Type Plugin Vulnerable versions = 1.9.217 Fixed in 1.9.218 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-5424 Patch priority Low CVSS severity Low 4.7 Developer WS Form PSID 7d55c6663718 Credits Duc Manh Required privilege Unauthenticated Published 7...