Show filters
32 Total Results
Displaying 11-20 of 32
Sort by:
Attacker Value
Unknown
CVE-2023-34005
Disclosure Date: July 17, 2023 (last updated October 08, 2023)
Cross-Site Request Forgery (CSRF) vulnerability in Etoile Web Design Front End Users plugin <= 3.2.24 versions.
0
Attacker Value
Unknown
CVE-2023-2711
Disclosure Date: June 27, 2023 (last updated October 08, 2023)
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
0
Attacker Value
Unknown
CVE-2020-36726
Disclosure Date: June 07, 2023 (last updated October 08, 2023)
The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input in several vulnerable functions. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin.
0
Attacker Value
Unknown
CVE-2022-0591
Disclosure Date: March 21, 2022 (last updated February 23, 2025)
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
0
Attacker Value
Unknown
CVE-2021-24993
Disclosure Date: February 07, 2022 (last updated February 23, 2025)
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
0
Attacker Value
Unknown
CVE-2021-24968
Disclosure Date: January 24, 2022 (last updated February 23, 2025)
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
0
Attacker Value
Unknown
CVE-2022-23979
Disclosure Date: January 06, 2022 (last updated February 23, 2025)
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
0
Attacker Value
Unknown
CVE-2020-24313
Disclosure Date: August 26, 2020 (last updated February 22, 2025)
Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointment_ID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
0
Attacker Value
Unknown
CVE-2020-7107
Disclosure Date: January 16, 2020 (last updated February 21, 2025)
The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.
0
Attacker Value
Unknown
CVE-2019-17233
Disclosure Date: October 07, 2019 (last updated November 27, 2024)
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
0
