CVE-2025-2484 - WordPress Multi Video Box Plugin Reflected Cross-Site Scripting Vulnerability

22.03.2025 07:15

CVE-2025-2484 - WordPress Multi Video Box Plugin Reflected Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-2484 Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago Description : The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘video_id’ and ‘group_id’ parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output

CVE ID : CVE-2025-2484
Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago
Description : The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘video_id’ and ‘group_id’ parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2024-13856 - WordPress Make Builder SSRF

22.03.2025 07:15

CVE-2024-13856 - WordPress Make Builder SSRF

CVE ID : CVE-2024-13856 Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago Description : The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.10 via the make_builder_ajax_subscribe() function. This makes

CVE ID : CVE-2024-13856
Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago
Description : The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.10 via the make_builder_ajax_subscribe() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-0807 - WordPress CITS Support Use Custom Fonts CSRF

22.03.2025 07:15

CVE-2025-0807 - WordPress CITS Support Use Custom Fonts CSRF

CVE ID : CVE-2025-0807 Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago Description : The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to

CVE ID : CVE-2025-0807
Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago
Description : The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation on the cits_settings_tab() function. This makes it possible for unauthenticated attackers to update the plugin’s settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-1311 - WooCommerce Multivendor Marketplace - SQL Injection

22.03.2025 07:15

CVE-2025-1311 - WooCommerce Multivendor Marketplace - SQL Injection

CVE ID : CVE-2025-1311 Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago Description : The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in the update_delivery_status() function in all versions up to, and including, 1.6.2 due to insufficient

CVE ID : CVE-2025-1311
Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago
Description : The WooCommerce Multivendor Marketplace – REST API plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in the update_delivery_status() function in all versions up to, and including, 1.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-2303 - Block Logic - WordPress Full Gutenberg Block Display Control Remote Code Execution

22.03.2025 07:15

CVE-2025-2303 - Block Logic - WordPress Full Gutenberg Block Display Control Remote Code Execution

CVE ID : CVE-2025-2303 Published : March 22, 2025, 7:15 a.m. | 7 hours, 3 minutes ago Description : The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.8 via the block_logic_check_logic function. This is due to

CVE ID : CVE-2025-2303
Published : March 22, 2025, 7:15 a.m. | 7 hours, 3 minutes ago
Description : The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.8 via the block_logic_check_logic function. This is due to the unsafe evaluation of user-controlled input. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-2477 - CryoKey WordPress Reflected Cross-Site Scripting Vulnerability

22.03.2025 07:15

CVE-2025-2477 - CryoKey WordPress Reflected Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-2477 Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago Description : The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it

CVE ID : CVE-2025-2477
Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago
Description : The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-2478 - WordPress Code Clone SQL Injection Vulnerability

22.03.2025 07:15

CVE-2025-2478 - WordPress Code Clone SQL Injection Vulnerability

CVE ID : CVE-2025-2478 Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago Description : The Code Clone plugin for WordPress is vulnerable to time-based SQL Injection via the ‘snippetId’ parameter in all versions up to, and including, 0.9 due to insufficient escaping on the user supplied parameter and

CVE ID : CVE-2025-2478
Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago
Description : The Code Clone plugin for WordPress is vulnerable to time-based SQL Injection via the ‘snippetId’ parameter in all versions up to, and including, 0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2024-13768 - WordPress CITS Support svg webp Media and TTFOTF File Upload Use Custom Fonts CSRF

22.03.2025 07:15

CVE-2024-13768 - WordPress CITS Support svg webp Media and TTFOTF File Upload Use Custom Fonts CSRF

CVE ID : CVE-2024-13768 Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago Description : The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to

CVE ID : CVE-2024-13768
Published : March 22, 2025, 7:15 a.m. | 7 hours, 31 minutes ago
Description : The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation on the cits_assign_fonts_tab() function. This makes it possible for unauthenticated attackers to delete font assignments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-0723 - ProfileGrid WordPress SQL Injection Vulnerability

22.03.2025 05:15

CVE-2025-0723 - ProfileGrid WordPress SQL Injection Vulnerability

CVE ID : CVE-2025-0723 Published : March 22, 2025, 5:15 a.m. | 8 hours, 44 minutes ago Description : The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due

CVE ID : CVE-2025-0723
Published : March 22, 2025, 5:15 a.m. | 8 hours, 44 minutes ago
Description : The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-0724 - ProfileGrid WordPress PHP Object Injection Vulnerability

22.03.2025 05:15

CVE-2025-0724 - ProfileGrid WordPress PHP Object Injection Vulnerability

CVE ID : CVE-2025-0724 Published : March 22, 2025, 5:15 a.m. | 9 hours, 3 minutes ago Description : The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization of untrusted input in the get_user_meta_fields_html function.

CVE ID : CVE-2025-0724
Published : March 22, 2025, 5:15 a.m. | 9 hours, 3 minutes ago
Description : The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization of untrusted input in the get_user_meta_fields_html function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Previous Page 3 of 576 Next Page