10 Ergebnisse
6.1Mittel
CVE-2024-13362

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

sebet Go Fetch Jobs (for WP Job Manager); 5starplugins Dynamic Copyright Year; peterschulznl Code Manager; bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject …

6.4Mittel
CVE-2026-0563

WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' Shortcode

pagup WP Google Street View (with 360° virtual tour) & Google maps + Local SEO

The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpgsv_map' shortcode in all versions up to, and including, 1.1.8 due to insufficient input sanitization and…

6.4Mittel
CVE-2025-15019

BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)

The BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bialty_cs_alt' post meta in all versions up to, and including, 2.2.1 due to insufficient input sa…

6.4Mittel
CVE-2024-13542

WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

pagup WP Google Street View (with 360° virtual tour) & Google maps + Local SEO

The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitizatio…

4.9Mittel
CVE-2024-11009

Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter

pagup Automatic Internal Links for SEO by Pagup

The Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and including, 1.2.1 due to insufficient escaping on the us…

6.3Mittel
CVE-2022-4974

Freemius SDK <= 2.4.2 - Missing Authorization Checks

dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress; nicheaddons Events Addon for Elementor; dots Fraud Prevention For WooCommerce and EDD; wpengine Gutenberg Blocks – ACF Blocks Suite

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_d…