These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Redux Framework plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 4.5.14. This allows authenticated attackers with subscriber-level access and above to delete arbitrary media library attachments, including administrator-owned files. The vulnerability is due to the plugin not properly verifying that a user is authorized to perform an action. This makes i [truncated]
The Redux Framework plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the spinner field in versions up to, and including, 4.5.13. This is due to insufficient input sanitization and output escaping. In the user_meta_save() function, scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitiz [truncated]
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13. This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, wi [truncated]
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictab [truncated]
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_una [truncated]
A reflected cross-site scripting (XSS) vulnerability exists in the Easy Updates Manager WordPress plugin, affecting versions up to and including 9.0.20. The flaw resides in the pagination() function, where insufficient input sanitization and output escaping of the 'paged' parameter allow attackers to inject arbitrary web scripts. Successful exploitation requires tricking an administrator into clicking a m [truncated]
