CVE Veritabanı

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions.

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

Administrator SQL Injection in Email Log <= 2.63 versions.

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.

Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.

Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.

Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.

Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.

Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.

Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.

Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.

Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.