Search Results (Refine Search)
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2024-2739 |
The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Published: April 15, 2024; 1:15:15 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1849 |
The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL Published: April 15, 2024; 1:15:15 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1846 |
The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Published: April 15, 2024; 1:15:15 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1755 |
The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Published: April 15, 2024; 1:15:15 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1754 |
The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Published: April 15, 2024; 1:15:15 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1746 |
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1712 |
The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1660 |
The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1310 |
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products) Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1307 |
The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1306 |
The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk. Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-1204 |
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts. Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-0902 |
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-0399 |
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role. Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2023-7201 |
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup) Published: April 15, 2024; 1:15:14 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2023-6067 |
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Published: April 15, 2024; 1:15:13 AM -0400 |
V3.x:(not available) V2.0:(not available) |
CVE-2024-3778 |
The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code. Published: April 15, 2024; 12:15:16 AM -0400 |
V3.1: 7.2 HIGH V2.0:(not available) |
CVE-2024-3777 |
The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password. Published: April 15, 2024; 12:15:16 AM -0400 |
V3.1: 9.8 CRITICAL V2.0:(not available) |
CVE-2024-3776 |
The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks. Published: April 15, 2024; 12:15:16 AM -0400 |
V3.1: 6.1 MEDIUM V2.0:(not available) |
CVE-2024-3775 |
aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files. Published: April 15, 2024; 12:15:16 AM -0400 |
V3.1: 5.3 MEDIUM V2.0:(not available) |