All CVEs — page 335 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw in TillKit WordPress plugin allows unauthenticated attackers to obtain a privileged Point of Sale (POS) session, leading to unauthorized access to customer and site-user personal data and potential store data modifications.
The flaw lies in the SaveTo Wishlist Lite WordPress plugin, which fails to properly sanitize parameters used in SQL queries, allowing unauthenticated attackers to inject additional SQL commands and potentially extract sensitive data.
This flaw allows unauthenticated users to inject malicious HTML, leading to Cross-Site Scripting (XSS) attacks that can execute arbitrary scripts in the context of any visitor or an administrator reviewing the content.
The GeoDirectory WordPress plugin contains a SQL injection vulnerability in versions up to 2.8.186 where stored latitude/longitude coordinates are not properly escaped, allowing attackers to inject malicious SQL into distance calculation queries. This enables authenticated users with subscriber-level access or higher to extract sensitive database information.
The WP 2FA WordPress plugin fails to invalidate used time-based one-time passcodes, allowing attackers to replay valid codes and bypass two-factor authentication. This creates a persistent backdoor for authenticated users to gain unauthorized access to administrator accounts.
The flaw allows unauthenticated attackers to delete arbitrary posts, pages, products, or media attachments by exploiting the Photo Reviews for WooCommerce plugin in versions up to 1.2.30.
The WP Ultimate Review plugin has a vulnerability where unauthenticated users can inject crafted review content that causes fatal errors on every page visit, leading to persistent denial of service. This affects sites where review display settings have never been saved.
The WP Ultimate Review plugin fails to validate review ratings as numeric values, allowing unauthenticated users to submit non-numeric ratings that cause fatal errors when rendering reviews, leading to persistent denial of service for all site visitors.
The WP Ultimate Review plugin allows unauthenticated users to submit reviews with malicious scripts that get stored and executed when other users view those reviews, potentially leading to admin compromise.