All In One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic Security Vulnerabilities

Tuesday, July 2, 2024 Security Releases

Summary The Node.js project will release new versions of the 22.x, 20.x, 18.x releases lines on or shortly after, Tuesday, July 2, 2024 in order to address: 1 high severity issues. 2 medium severity issues. 3 low severity issues. Node.js fetch will be upgraded to undici v6.19.2 on Node.js 18.x...

CVE-2024-6363

The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-5790

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Gradient Heading widget in all versions up to, and including, 3.11.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-5790

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Gradient Heading widget in all versions up to, and including, 3.11.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-6363

The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-5666

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5666

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5666 Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-5790 Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Gradient Heading widget in all versions up to, and including, 3.11.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-6363 Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode

The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-5889

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-5942

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access....

CVE-2024-6265

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied....

CVE-2024-5942

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access....

CVE-2024-6265

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied....

CVE-2024-5889

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-5598

The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive...

CVE-2024-5192

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes’ parameter in all versions up to, and including, 3.3.1 due to insufficient...

CVE-2024-5192

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes’ parameter in all versions up to, and including, 3.3.1 due to insufficient...

CVE-2024-5598

The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive...

CVE-2024-5598 Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing

The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.4 via the 'fma_local_file_system' function. This makes it possible for unauthenticated attackers to extract sensitive data including backups or other sensitive...

CVE-2024-6265 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied....

CVE-2024-5889 Events Manager <= 6.4.8 - Reflected Cross-Site Scripting

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-5942 Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access....

CVE-2024-5192 Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes’ parameter in all versions up to, and including, 3.3.1 due to insufficient...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: cilium-envoy, nodetaint, gomplate, aws-efs-csi-driver, tctl, node-problem-detector, newrelic-infrastructure-agent, src, telegraf, skaffold, envoy-ratelimit, prometheus-adapter, buildkitd, oauth2-proxy, kpt, grpcurl, pulumi-language-java, pulumi-language-yaml, pulumi,.....

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, trust-manager, nodetaint, buf, gomplate, prometheus-operator, helm-operator, prometheus-postgres-exporter, grpc-health-probe, vexctl, kubernetes-dns-node-cache, grafana-agent-operator, aws-efs-csi-driver, containerd, cilium, tctl,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: cni-plugins, kubeflow-pipelines, nodetaint, docker-credential-acr-env, gomplate, nats-server, delve, regclient, prometheus-operator, helm-operator, prometheus-postgres-exporter, vexctl, docker-cli, kubernetes-dns-node-cache, dask-gateway, aws-efs-csi-driver, mage,...

GHSA-VVPX-J8F3-3W6H vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, hey, restic, dynamic-localpv-provisioner, falco, grpcurl, wireguard-go, go,...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: nerdctl, docker, ingress-nginx-controller, runc, grype, kots, newrelic-infrastructure-agent, telegraf, k9s, skaffold, nvidia-device-plugin, buildkitd, kubernetes, kubescape, cadvisor, ctop, zarf, skopeo, zot, k3s, wolfictl, syft, k3d, trivy, datadog-agent,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: cni-plugins, gomplate, nats-server, vexctl, docker-cli, containerd, nri-elasticsearch, nri-jmx, xcaddy, yam, newrelic-infrastructure-agent, spire-server, ipfs, nri-nginx, telegraf, bincapz, flannel-cni-plugin, cadvisor, pulumi, gobump, sbom-scorecard, zot, ytt,...

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, trust-manager, docker-credential-acr-env, gomplate, stern, nats-server, delve, regclient, helm-operator, go-fips, kubernetes-dns-node-cache, dask-gateway, grafana-agent-operator, step, aws-efs-csi-driver, spegel, containerd, mage,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: local-static-provisioner, trust-manager, docker-credential-acr-env, gomplate, stern, nats-server, delve, regclient, helm-operator, go-fips, kubernetes-dns-node-cache, dask-gateway, grafana-agent-operator, step, aws-efs-csi-driver, spegel, containerd, mage,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: cni-plugins, local-static-provisioner, gomplate, nats-server, vexctl, nri-elasticsearch, nri-jmx, xcaddy, yam, newrelic-infrastructure-agent, spire-server, ipfs, nri-nginx, telegraf, flannel-cni-plugin, cadvisor, gobump, sbom-scorecard, ytt,...

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: cni-plugins, cilium-envoy, kubernetes-dashboard-metrics-scraper, go-bindata, prometheus-stackdriver-exporter, falco, wait-for-port, slsa-verifier, render-template, configmap-reload, docker-cli, scorecard, kind, ip-masq-agent, mage, aws-flb-kinesis,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: trust-manager, nodetaint, gomplate, prometheus-operator, prometheus-postgres-exporter, aws-efs-csi-driver, containerd, tctl, node-problem-detector, newrelic-infrastructure-agent, src, telegraf, tkn, skaffold, prometheus-adapter, buildkitd, apko, oauth2-proxy, kpt,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, trust-manager, nodetaint, buf, gomplate, prometheus-operator, helm-operator, prometheus-postgres-exporter, grpc-health-probe, vexctl, kubernetes-dns-node-cache, grafana-agent-operator, aws-efs-csi-driver, containerd, cilium, tctl,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: cni-plugins, kubeflow-pipelines, nodetaint, docker-credential-acr-env, gomplate, nats-server, delve, regclient, prometheus-operator, helm-operator, prometheus-postgres-exporter, vexctl, docker-cli, kubernetes-dns-node-cache, dask-gateway, aws-efs-csi-driver, mage,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: cni-plugins, kubeflow-pipelines, nodetaint, docker-credential-acr-env, gomplate, nats-server, delve, regclient, prometheus-operator, helm-operator, prometheus-postgres-exporter, vexctl, docker-cli, kubernetes-dns-node-cache, dask-gateway, aws-efs-csi-driver, mage,...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: prometheus, guac, grafana, rekor, teleport, up, chezmoi, cosign, prometheus-operator, policy-controller, opentelemetry-collector-contrib, grafana-agent-operator, step, sigstore-scaffolding, k8sgpt, tekton-pipelines, filebeat, flyte, hugo,...

GHSA-M5VV-6R4H-3VJ9 vulnerabilities

Vulnerabilities for packages: prometheus, guac, grafana, rekor, teleport, up, chezmoi, cosign, prometheus-operator, policy-controller, opentelemetry-collector-contrib, grafana-agent-operator, step, sigstore-scaffolding, k8sgpt, tekton-pipelines, filebeat, flyte, hugo,...

CVE-2022-41723 vulnerabilities

Vulnerabilities for packages: gke-gcloud-auth-plugin, hey, restic, dynamic-localpv-provisioner, falco, grpcurl, wireguard-go, go,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: cni-plugins, gomplate, nats-server, vexctl, docker-cli, containerd, nri-elasticsearch, nri-jmx, xcaddy, yam, newrelic-infrastructure-agent, spire-server, ipfs, nri-nginx, telegraf, bincapz, flannel-cni-plugin, cadvisor, pulumi, gobump, sbom-scorecard, zot, ytt,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: local-static-provisioner, trust-manager, docker-credential-acr-env, gomplate, stern, nats-server, delve, regclient, helm-operator, kubernetes-dns-node-cache, dask-gateway, grafana-agent-operator, step, aws-efs-csi-driver, spegel, containerd, mage,...

CVE-2024-24790 vulnerabilities

Vulnerabilities for packages: cni-plugins, local-static-provisioner, gomplate, nats-server, vexctl, nri-elasticsearch, nri-jmx, xcaddy, yam, newrelic-infrastructure-agent, spire-server, ipfs, nri-nginx, telegraf, flannel-cni-plugin, cadvisor, gobump, sbom-scorecard, ytt,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: trust-manager, nodetaint, gomplate, prometheus-operator, prometheus-postgres-exporter, kubernetes-dns-node-cache, aws-efs-csi-driver, containerd, tctl, node-problem-detector, newrelic-infrastructure-agent, src, telegraf, istio-operator, tkn, skaffold,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: cni-plugins, kubeflow-pipelines, nodetaint, docker-credential-acr-env, gomplate, nats-server, delve, regclient, prometheus-operator, helm-operator, prometheus-postgres-exporter, vexctl, docker-cli, kubernetes-dns-node-cache, dask-gateway, aws-efs-csi-driver, mage,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: cni-plugins, kubeflow-pipelines, nodetaint, docker-credential-acr-env, gomplate, nats-server, delve, regclient, prometheus-operator, helm-operator, prometheus-postgres-exporter, vexctl, docker-cli, kubernetes-dns-node-cache, dask-gateway, aws-efs-csi-driver, mage,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: cni-plugins, kubeflow-pipelines, nodetaint, docker-credential-acr-env, gomplate, nats-server, delve, regclient, prometheus-operator, helm-operator, prometheus-postgres-exporter, vexctl, docker-cli, kubernetes-dns-node-cache, dask-gateway, aws-efs-csi-driver, mage,...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: cni-plugins, local-static-provisioner, gomplate, nats-server, vexctl, nri-elasticsearch, nri-jmx, xcaddy, yam, newrelic-infrastructure-agent, spire-server, ipfs, nri-nginx, telegraf, flannel-cni-plugin, cadvisor, gobump, sbom-scorecard, ytt,...