Kinorth

The Kalles Addons plugin for WordPress is susceptible to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The impact of this issue depends on the presence of a POP chain (a sequence of gadgets used to achieve code execution or other malicious actions) within other installed plugins or themes. If such a chain exists, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

The WPeMatico RSS Feed Fetcher plugin for WordPress contains a stored Cross-Site Scripting (XSS) flaw. This issue occurs because the software fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page.

An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the victim's browser without requiring authentication.

The Werkstatt - Creative Portfolio WordPress Theme is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject a PHP Object. This issue affects authenticated users with contributor-level access and above. While no native POP chain (a sequence of gadgets used to achieve code execution) is present in the software, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

An unauthenticated Cross Site Scripting (XSS) issue exists, allowing an attacker to execute malicious scripts in the browser of a user without requiring authentication.

An unauthenticated Cross Site Scripting (XSS) issue exists, allowing attackers to execute malicious scripts without authentication.

Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Unauthenticated Cross Site Scripting (XSS) allows an attacker to execute malicious scripts in the browser of a user without requiring authentication.

An issue exists where incorrectly configured access control security levels lead to missing authorization, allowing for potential exploitation.

An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication.

An unauthenticated Local File Inclusion (LFI) issue exists, which allows an attacker to read files from the local file system without requiring authentication.

The TheFox theme for WordPress is subject to Reflected Cross-Site Scripting (XSS), a flaw where malicious scripts are reflected off a web application to the victim's browser. This occurs due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute if a user is tricked into performing an action, such as clicking a malicious link.

An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication.

Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a user is tricked into performing an action, such as clicking a link.

An unauthenticated Cross-Site Request Forgery (CSRF) issue exists in the Real Estate 7 WordPress theme. This occurs due to missing or incorrect nonce validation—a security mechanism used to ensure that a request was intentionally sent by the user—within a function. This allows an attacker to perform unauthorized actions by tricking a site administrator into clicking a malicious link.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Cross Site Scripting (XSS) exists in the software, allowing users with contributor-level permissions to execute malicious scripts in the browser of other users.

An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication.

An unauthenticated cross-site scripting (XSS) flaw exists in the web-facing input handling. The issue stems from improper input validation and output encoding, which allows attacker-supplied content to be rendered as an active script in the browser. A remote attacker can inject malicious payloads into exposed parameters or fields without authentication. If an administrator or user interacts with the crafted content, it can lead to session hijacking, admin account takeover via stolen cookies or nonces, and malicious redirects.

An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.