CVE Database

Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to arbitrary locations the current user has write access, including the Windows Startup folder, enabling persistent code execution on the next user login.

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.

Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &amp; Embedder <= 1.4.2 versions.

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

Unauthenticated Sensitive Data Exposure in Byteflows Travel &amp; Hotel Booking <= 1.0.0 versions.

Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.

Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.

Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.