Archives: Vulnerabilities
Input validation vulnerability in Estatik Real Estate Plugin 4.1.13
The Estatik plugin for WordPress has a security problem that could allow hackers to insert dangerous code into web pages. This can happen in versions 4.1.13 and earlier because the plugin does not properly clean up user input and output. As a result, hackers with certain levels of access can add harmful scripts to pages that will activate whenever someone visits that page.
Output validation vulnerability in Translate Multilingual sites – TranslatePress 2.10.2
A popular plugin for WordPress called TranslatePress has a security vulnerability that allows attackers to inject malicious code into a website. This can only happen if the website has another plugin or theme with a specific type of code called a POP chain. If the website does not have this type of code, the vulnerability has no impact. However, if the website does have this code, the attacker may be able to delete files, access sensitive information, or even run
Input validation vulnerability in Fintelligence Calculator 1.0.3
The Fintelligence Calculator plugin for WordPress has a security issue called Stored Cross-Site Scripting. This happens when the plugin’s ‘fintelligence-calculator’ shortcode doesn’t properly clean up user inputs, making it possible for attackers with contributor-level access or higher to insert harmful code on pages that will run when a user visits that page.
Access violation vulnerability in Sertifier Certificate & Badge Maker for WordPress – Tutor LMS 1.21
The plugin called Sertifier Certificate & Badge Maker for WordPress is not secure because it does not have a way to check if someone is allowed to use a certain function. This means that people who are logged in and have at least subscriber-level access can do things they are not supposed to do.
Input validation vulnerability in Slick Google Map 0.3
The Slick Google Map plugin for WordPress has a security vulnerability in versions 0.3 and below. This means that attackers who are not logged in can trick site administrators into doing something they shouldn’t, like clicking on a harmful link.