CVE-2024-3591

CVE-2024-3591 affects the WordPress plugin Geo Controller up to version 8.6.5. The issue arises from unserializing user input in certain AJAX actions and REST API routes, enabling unauthenticated users to perform a PHP Object Injection if a suitable gadget is present on the blog. Evidence across ...

CVE-2024-7380

CVE-2024-7380 — Geo Controller (WordPress) security issue : The Geo Controller plugin (WordPress) up to and including version 8.6.9 is vulnerable to unauthorized menu creation/deletion due to missing capability checks in ajax__geolocate_menu and ajax__geolocate_remove_menu. Affected product: Geo ...

CVE-2024-7381

CVE-2024-7381 : The WordPress plugin Geo Controller is vulnerable to unauthenticated shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to and including 8.6.9. This allows unauthenticated attackers to execute arbitrary s...