IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
5.3Mittel

CVE-2024-7381Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution

creativform Geo Controller; wordpress geo_controller Veröffentlicht: (vor 2 Jahren)

Beschreibung

The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.

Schwachstellentyp (CWE): CWE-862

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
creativform Geo Controller ≤ 8.6.9
wordpress geo_controller ≤ 8.6.9

Referenzen und Patches

Neue CVEs im selben Produkt — WordPress plugins & themes

5.4Mittel
CVE-2026-120035

RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title

themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and inclu…