cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2024-11642,https://securityvulnerability.io/vulnerability/CVE-2024-11642,Local File Inclusion Vulnerability in Post Grid Master Plugin for WordPress,"The Post Grid Master plugin for WordPress is prone to a Local File Inclusion vulnerability via the 'locate_template' function. This flaw allows unauthorized attackers to incorporate and execute arbitrary files on the server, leading to potential execution of malicious PHP code. Attackers may leverage this vulnerability to bypass access restrictions, extract sensitive data, or perform code execution when legitimate file types such as images can be uploaded and included. The impacted .php files pose a significant risk, and users are urged to update to more secure versions promptly.",Wordpress,"Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything With Infinite Scroll, Load More, Pagination & Shortcode Builder",9.8,CRITICAL,0.000910000002477318,false,,false,false,false,,false,false,false,,2025-01-09T11:11:03.716Z,0
CVE-2024-10040,https://securityvulnerability.io/vulnerability/CVE-2024-10040,Infinite-Scroll Plugin Vulnerable to Cross-Site Request Forgery,"The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation on the process_ajax_edit and process_ajax_delete function. This makes it possible for unauthenticated attackers to make changes to plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",Wordpress,Infinite-scroll,4.3,MEDIUM,0.0005200000014156103,false,,false,false,false,,,false,false,,2024-10-18T04:32:52.212Z,0
CVE-2024-8505,https://securityvulnerability.io/vulnerability/CVE-2024-8505,Plugin Vulnerable to Stored Cross-Site Scripting,"The Infinite Scroll – Ajax Load More plugin for WordPress contains a vulnerability that allows authenticated attackers with Contributor-level access or higher to exploit the ‘button_label’ parameter. This flaw arises from inadequate input sanitization and output escaping, enabling attackers to inject arbitrary web scripts into web page content. When a user accesses these compromised pages, the injected scripts execute, potentially compromising user information and site integrity. All versions up to and including 7.1.2 are affected, highlighting the importance of updating to the latest version to mitigate these risks.",Wordpress,WordPress Infinite Scroll – Ajax Load More,5.4,MEDIUM,0.0005200000014156103,false,,false,false,false,,,false,false,,2024-10-02T09:31:59.680Z,0
CVE-2024-4711,https://securityvulnerability.io/vulnerability/CVE-2024-4711,Stored Cross-Site Scripting Vulnerability in WordPress Infinite Scroll Plugin,"The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ajax_load_more shortcode in versions up to, and including, 7.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",Wordpress,WordPress Infinite Scroll – Ajax Load More,5.4,MEDIUM,0.0006000000284984708,false,,false,false,false,,,false,false,,2024-06-01T02:32:47.560Z,0
CVE-2024-1790,https://securityvulnerability.io/vulnerability/CVE-2024-1790,Path Traversal Vulnerability in WordPress Ajax Load More Plugin by WordPress,"The Ajax Load More plugin for WordPress is susceptible to a path traversal vulnerability that allows authenticated users with administrator-level access to access sensitive files on the server. By exploiting the 'type' parameter, attackers can read arbitrary files, potentially exposing confidential information. This issue specifically affects installations on Windows servers and impacts all versions up to and including 7.0.1. Users are advised to upgrade to the latest version to mitigate this risk.",Wordpress,WordPress Infinite Scroll – Ajax Load More,4.9,MEDIUM,0.00044999999227002263,false,,false,false,false,,,false,false,,2024-04-09T18:59:03.441Z,0
CVE-2023-50874,https://securityvulnerability.io/vulnerability/CVE-2023-50874,WordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS),"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1.

",Wordpress,WordPress Infinite Scroll – Ajax Load More,6.5,MEDIUM,0.0004799999878741801,false,,false,false,false,,,false,false,,2023-12-28T10:15:00.000Z,0
CVE-2022-4466,https://securityvulnerability.io/vulnerability/CVE-2022-4466,WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSS,"The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.",Wordpress,WordPress Infinite Scroll,5.4,MEDIUM,0.000539999979082495,false,,false,false,false,,,false,false,,2023-03-13T16:03:37.989Z,0
CVE-2022-2943,https://securityvulnerability.io/vulnerability/CVE-2022-2943,WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read,"The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrative privileges, to download arbitrary files hosted on the server that may contain sensitive content, such as the wp-config.php file.",Wordpress,WordPress Infinite Scroll – Ajax Load More,4.9,MEDIUM,0.0015200000489130616,false,,false,false,false,,,false,false,,2022-09-06T17:19:02.000Z,0
CVE-2022-2945,https://securityvulnerability.io/vulnerability/CVE-2022-2945,WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Directory Traversal,"The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to read the contents of arbitrary files on the server, which can contain sensitive information.",Wordpress,WordPress Infinite Scroll – Ajax Load More,4.9,MEDIUM,0.002859999891370535,false,,false,false,false,,,false,false,,2022-09-06T17:19:01.000Z,0
CVE-2022-2433,https://securityvulnerability.io/vulnerability/CVE-2022-2433,WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Cross-Site Request Forgery to PHAR Deserialization,"The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.",Wordpress,WordPress Infinite Scroll – Ajax Load More,8.8,HIGH,0.003229999914765358,false,,false,false,false,,,false,false,,2022-09-06T17:18:56.000Z,0
CVE-2021-24752,https://securityvulnerability.io/vulnerability/CVE-2021-24752,Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change,"Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.",Wordpress,"Essential Widgets,To Top,Header Enhancement,Generate Child Theme,Essential Content Types,Catch Web Tools,Catch Under Construction,Catch Themes Demo Import,Catch Sticky Menu,Catch Scroll Progress Bar,Social Gallery And Widget,Catch Infinite Scroll,Catch Import Export,Catch Gallery,Catch Duplicate Switcher,Catch Breadcrumb,Catch Ids",5.7,MEDIUM,0.000539999979082495,false,,false,false,false,,,false,false,,2021-10-18T13:46:10.000Z,0