12916 matches found
CVE-2024-6282
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-jltma-wrapper-link element in all versions up to, and including 2.0.6.4 due to insufficient input sanitization and output...
Vulnerabilities fixed in QNAP QTS and QTS Hero
QNAP has fixed vulnerabilities in QTS and QTS Hero. A malicious party could exploit the vulnerabilities to grant themselves elevated privileges, access sensitive data or execute arbitrary OS commands. For successful abuse, the malicious party must already have prior authentication. QNAP has...
CVE-2024-8241 Nova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute
The Nova Blocks by Pixelgrade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' attribute of the 'wp:separator' Gutenberg block in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This...
CVE-2024-7618
CVE-2024-7618 — The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the content parameter in all versions up to and including 6.4.5.0. The issue requires an administrator-level (authenticated) atta...
CVE-2024-7655
CVE-2024-7655 affects the WordPress plugin Community by PeepSo – Social Network, Membership, Registration, User Profiles, up to and including version 6.4.5.0. The issue is Stored Cross-Site Scripting caused by insufficient input sanitization and output escaping, exploitable by authenticated attac...
CVE-2024-8268
CVE-2024-8268 affects the Frontend Dashboard WordPress plugin (versions
PT-2025-3964 · Sante · Sante Pacs Server Web Portal Dcm
Name of the Vulnerable Software and Affected Versions: Sante PACS Server Web Portal DCM affected versions not specified Description: This issue allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is required to exploit this issue. The...
PT-2024-39123 · Techexcel · Techexcel Back Office
Name of the Vulnerable Software and Affected Versions: TechExcel Back Office Software versions prior to 1.0.0 Description: This issue exists due to improper access controls on certain API endpoints, allowing an authenticated remote attacker to exploit the vulnerability by manipulating a parameter...
CVE-2024-6849
The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2024-6849 Preloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The Preloader Plus – WordPress Loading Screen Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2024-6849
The CVE-2024-6849 entry concerns the WordPress plugin Preloader Plus – WordPress Loading Screen Plugin, affected in all versions up to and including 2.2.1. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by insufficient input sanitization and output escaping during SVG file u...
CVE-2024-7611
The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied...
CVE-2024-7622
The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the aajaxQuickEmailTestCallback function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2024-7611 Enter Addons – Ultimate Template Builder for Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget
The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied...
CVE-2024-7622 Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the aajaxQuickEmailTestCallback function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2024-8317
The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘adalignment’ attribute in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2024-8427
CVE-2024-8427 affects the WordPress plugin Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin (
CVE-2024-8317
CVE-2024-8317 concerns the WordPress plugin WP AdCenter – Ad Manager & Adsense Ads. The vulnerability is a stored cross-site scripting (XSS) via the ad_alignment attribute affecting all versions up to and including 2.5.6. Exploitation requires authenticated access at Contributor level or higher, ...
CVE-2024-8480
CVE-2024-8480 affects the WordPress plugin “Image Optimizer, Resizer and CDN – Sirv” up to version 7.2.7. The root cause is a missing capability check in sirv_save_prevented_sizes, allowing authenticated users with Contributor+ access to trigger sirv_upload_file_by_chunks_callback with insufficie...