Filtered by vendor Kraftplugins Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-47311 1 Kraftplugins 1 Wheel Of Life 2024-11-12 5.3 Medium
Missing Authorization vulnerability in Kraft Plugins Wheel of Life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through 1.1.8.
CVE-2024-49693 1 Kraftplugins 1 Mega Elements 2024-11-08 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kraftplugins Mega Elements allows Stored XSS.This issue affects Mega Elements: from n/a through 1.2.6.
CVE-2024-9172 1 Kraftplugins 1 Demo Importer Plus 2024-10-08 6.4 Medium
The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVE-2024-37466 1 Kraftplugins 1 Mega Elements 2024-08-02 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kraftplugins Mega Elements.This issue affects Mega Elements: from n/a through 1.2.2.
CVE-2024-3627 1 Kraftplugins 1 Wheel Of Life 2024-08-01 5.4 Medium
The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts and modify settings.