CVE-2024-43949

CVE-2024-43949 is a Stored XSS vulnerability in the GHActivity WordPress plugin (Automattic GHActivity) that arises from improper neutralization of input during web page generation. Affected versions are reported as GHActivity from n/a through 2.0.0-alpha. The issue enables stored cross-site scri...

CVE-2024-43949 WordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Automattic GHActivity allows Stored XSS.This issue affects GHActivity: from n/a through 2.0.0-alpha...

CVE-2024-43949 WordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Automattic GHActivity allows Stored XSS.This issue affects GHActivity: from n/a through 2.0.0-alpha...

PT-2024-30810 · Automattic · Ghactivity

Name of the Vulnerable Software and Affected Versions: Automattic GHActivity versions n/a through 2.0.0-alpha Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, where an attacker can...

CVE-2024-35686

Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro WC Paid Courses.This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro WC Paid Courses: from n/a through 4.23.1.1.23.1...

CVE-2024-39666

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 9.1.2...

CVE-2024-39666

CVE-2024-39666 is an XSS vulnerability in Automattic WooCommerce (Improp­er Neutralization of Input During Web Page Generation). Public description states this affects WooCommerce: from n/a through 9.1.2. The Red Hat and EU vulnerability entries repeat the same description, confirming the issue i...

PT-2024-26634 · Automattic · Automattic Sensei Pro +1

Name of the Vulnerable Software and Affected Versions: Automattic Sensei LMS versions 4.23.1 and earlier Automattic Sensei Pro WC Paid Courses versions 4.23.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in Automattic Sensei LMS and Automattic Sensei Pro ...

CVE-2024-37115

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic Newspack Blocks.This issue affects Newspack Blocks: from n/a through 3.0.8...

CVE-2024-37115

CVE-2024-37115 affects WordPress plugin Newspack Blocks (versions up to 3.0.8). The vulnerability exposes sensitive information to an unauthenticated actor (Unauthenticated Sensitive Information Exposure). CVSSv3.1 base score 7.5 (HIGH); attack vector NETWORK, no authentication required, confiden...

CVE-2024-37424

Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspack Blocks: from n/a through 3.0.8...

CVE-2024-37424

CVE-2024-37424 is an Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks (≤3.0.8) that allows uploading a web shell to the server. Root cause: unrestricted upload of dangerous file types. Impact: high (web shell can grant full control). Status: patched in v...

CVE-2024-37424 WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Automattic Newspack Blocks allows Upload a Web Shell to a Web Server.This issue affects Newspack Blocks: from n/a through 3.0.8...

CVE-2024-35777

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2...

CVE-2024-35777

CVE-2024-35777 is an Injection vulnerability in WooCommerce (WordPress plugin) that allows content spoofing via improper neutralization in output used by a downstream component. Affected versions are WooCommerce up to 8.9.2; exploitation was not indicated as in-the-wild within the provided disclo...

CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2...

CVE-2024-37474

Cross Site Scripting XSS vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1...

CVE-2024-37476

Cross Site Scripting XSS vulnerability in Automattic Newspack Campaigns allows Stored XSS.This issue affects Newspack Campaigns: from n/a through 2.31.1...

CVE-2024-37474 WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1...

CVE-2024-37474

CVE-2024-37474 is a Cross-Site Scripting (XSS) vulnerability in Automattic Newspack Ads for WordPress, allowing Stored XSS. Affected: Newspack Ads versions from n/a up to 1.47.1. Remediation: patch/update to 1.47.1 or later as indicated by the CVE record and Wordfence entry.