Plugin: Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Versions: <= 2.8.15
CVSS: 6.4/10
Correctif: 2.8.16

21 févr. 2025

Lire

MoyenneCVSS 4.1

CVE-2024-13900

Faille de sécurité, authentifié (Administrateur+), dans Head, Footer and Post Injections (<= 3.3.0)

Plugin: Head, Footer and Post Injections
Versions: <= 3.3.0
CVSS: 4.1/10
Correctif: 3.3.1

Injection SQL, authentifié (Abonné+), dans WPExperts Square For GiveWP (<= 1.3.1)

Plugin: WPExperts Square For GiveWP
Versions: <= 1.3.1
CVSS: 6.5/10
Correctif: 1.3.2

Injection SQL, authentifié (Administrateur+), dans Indeed Ultimate Learning Pro (<= 3.9)

Plugin: Indeed Ultimate Learning Pro
Versions: <= 3.9
CVSS: 4.9/10
Correctif: 3.9.1

XSS stocké, authentifié (Contributeur+), dans WP-Appbox (<= 4.5.4)

Plugin: WP-Appbox
Versions: <= 4.5.4
CVSS: 6.4/10
Correctif: 4.5.5

Inclusion de fichier local (LFI), authentifié (Contributeur+), dans Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates (<= 1.6.4)

Plugin: Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates
Versions: <= 1.6.4
CVSS: 8.8/10
Correctif: 1.6.5

Injection SQL, authentifié, dans Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (<= 2.9.2)

Plugin: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Versions: <= 2.9.2
CVSS: 5.3/10
Correctif: 2.10.0

XSS stocké, authentifié (Contributeur+), dans Pie Calendar – Events Calendar Made Simple (<= 1.2.5)

Plugin: Pie Calendar – Events Calendar Made Simple
Versions: <= 1.2.5
CVSS: 6.4/10
Correctif: 1.2.6

Injection SQL, non authentifié, dans Events Manager – Calendar, Bookings, Tickets, and more! (<= 6.6.3)

Plugin: Events Manager – Calendar, Bookings, Tickets, and more!
Versions: <= 6.6.3
CVSS: 7.5/10
Correctif: 6.6.4

20 févr. 2025

Lire

12181 – 12192 sur 32285 articles