Vulnerabilities
ELEX HelpDesk Plugin Permits Remote Code Execution via Unchecked File Uploads
Unauthenticated attackers can run arbitrary code on WordPress sites using the ELEX HelpDesk plugin, rated CVSS 9.8 by the NVD.
WordPress
Everything RedTeam Log has reported about WordPress: 4 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Snazzy Social Media Feed RCE Risk: Subscriber Access Triggers Critical Upload Flaw
Authenticated users with low-level access can execute code on sites using Snazzy Social Media Feed versions up to 2.5 via a missing security check.
Vulnerabilities
Blocksy Companion Plugin Allows Unauthenticated Users to Claim Seller Roles via Privilege Escalation
A critical flaw in the Blocksy Companion WordPress plugin enables unauthenticated attackers to bypass security checks and assume vendor roles, even when registration is disabled.
Vulnerabilities
Travesia WordPress Object Injection Flaw in Versions Up to 1.1.16 Poses Severe Risk to Administrators
A critical object injection flaw in the Travesia WordPress theme affects versions up to 1.1.16, posing severe risks to site administrators.