181
|
9.8 |
CRITICAL
Network
-
|
-
|
The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autol…
New
|
CWE-288
Authentication Bypass Using an Alternate Path or Channel
|
CVE-2024-9931
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
182
|
9.8 |
CRITICAL
Network
-
|
-
|
The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is due to missing validation on the user being supplied in the…
New
|
CWE-288
Authentication Bypass Using an Alternate Path or Channel
|
CVE-2024-9930
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
183
|
8.8 |
HIGH
Network
|
-
|
-
|
The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability check in the 'switchUser' function. This ma…
New
|
CWE-288
Authentication Bypass Using an Alternate Path or Channel
|
CVE-2024-9890
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
184
|
- |
|
-
|
-
|
The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta_set_featured_image' function in version…
New
|
-
|
CVE-2024-9626
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
185
|
6.1 |
MEDIUM
Network
|
-
|
-
|
The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and includin…
New
|
CWE-79
Cross-site Scripting
|
CVE-2024-9613
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
186
|
4.9 |
MEDIUM
Network
|
-
|
-
|
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6 due to …
New
|
CWE-89
SQL Injection
|
CVE-2024-9475
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
187
|
5.5 |
MEDIUM
Network
|
-
|
-
|
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Stored Cross-Site Scripting via poll settings in all versions up to, and including, 5.4.6 due to insu…
New
|
CWE-79
Cross-site Scripting
|
CVE-2024-9462
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
188
|
6.4 |
MEDIUM
Network
|
-
|
-
|
The PriPre plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.11 due to insufficient input sanitization and output escapi…
New
|
CWE-79
Cross-site Scripting
|
CVE-2024-9454
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
189
|
6.4 |
MEDIUM
Network
|
-
|
-
|
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Comparison Widget in all versions up to, and including, 3.2.9 due to insufficient inpu…
New
|
CWE-79
Cross-site Scripting
|
CVE-2024-10091
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
190
|
- |
|
-
|
-
|
pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a execut…
New
|
CWE-78
OS Command
|
CVE-2024-47821
|
2024-10-26 08:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|