Vantastic

An Insecure Direct Object Reference (IDOR) exists due to missing authentication and ownership verification when processing a user-supplied `comment id` in the comment edit path of the REST API endpoint. This allows unauthenticated attackers to edit arbitrary comments by providing a targeted comment ID, regardless of who owns the comment.

PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the object structure and potentially execute arbitrary code or perform unauthorized actions.

An issue exists that allows for PHP Object Injection, a condition where untrusted input is passed to the `unserialize()` function, potentially allowing an attacker to manipulate application logic or execute arbitrary code.

An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user controlled key. This allows unauthenticated attackers to perform unauthorized actions.

An issue allows unauthenticated users to perform privilege escalation, which enables an attacker to gain higher access levels within the system without providing valid credentials.

An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP `unserialize()` function, potentially allowing an attacker to manipulate objects and execute arbitrary code.

The JetEngine plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw. This occurs because the software fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page.

The JetEngine plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw. This occurs because the software fails to properly sanitize input and escape output, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute automatically when a user visits the affected page.

An unauthenticated SQL Injection allows an attacker to execute arbitrary SQL queries on the database without requiring valid credentials.

The JetEngine plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs when an application deserializes data from an untrusted source, potentially allowing an attacker to manipulate the object's properties. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Improper neutralization of input during web page generation allows for Reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation, enabling attackers to execute malicious scripts in the victim's browser.