CVE-2024-30429

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hans Matzen allows Stored XSS.This issue affects wp-forecast: from n/a through 9.2...

CVE-2024-30426

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3...

CVE-2024-30428

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Reflected XSS.This issue affects Contest Gallery: from n/a through = 24.0.3...

CVE-2022-47153

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPJobBoard Jobeleon Theme allows Reflected XSS.This issue affects Jobeleon Theme: from n/a through 1.9.1...

CVE-2024-30425

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows DOM-Based XSS.This issue affects Beaver Builder: from n/a through = 2.7.4.4...

CVE-2024-30502

CVE-2024-30502 affects WP Travel Engine (WordPress) up to version 5.7.9, with an unauthenticated SQL Injection caused by improper neutralization of input in the plugin. This can lead to full confidentiality, integrity, and availability impact as indicated by CVSS scores (NVD: 9.8 CRITICAL; ATT&CK...

CVE-2024-30501

The CVE-2024-30501 entry concerns WPChill’s Download Monitor plugin (WordPress) up to version 4.9.4, where an improper neutralization of SQL elements causes an SQL Injection. The vulnerability affects the plugin’s admin-facing code and can impact confidentiality, integrity, and availability as de...

CVE-2024-30499

CVE-2024-30499 corresponds to the CRM Perks Forms SQL Injection in the WordPress plugin. The initial description states an improper neutralization of SQL commands affecting CRM Perks Forms versions from n/a up to 1.1.4. Connected sources confirm a critical, unauthenticated or possibly authenticat...

CVE-2024-30495

CVE-2024-30495 is a SQL Injection in Falang multilanguage for WordPress (Falang plugin) affecting versions up to 1.3.47. The issue is an SQL injection via improper neutralization of input in Falang’s language handling. The Red Hat/WordPress ecosystem records this as patched; mitigation is to appl...

CVE-2024-30488

CVE-2024-30488 is tied to the Zotpress WordPress plugin (Zotpress, affected: n/a through 7.3.7) and is characterized as an SQL Injection. The linked Red Hat/WordFence entries confirm the issue exists as an authenticated (Contributor+) SQL injection against Zotpress and note a patched status, indi...

CVE-2024-30486

CVE-2024-30486 is an authenticated SQL injection in the WordPress plugin Media Library Folders (Media Library Folders: 8.1.7 and earlier). The issue arises from improper neutralization of input in SQL commands, enabling an attacker with Author+ or higher permissions to manipulate queries. The vul...

CVE-2024-30428

CVE-2024-30428 is described as a Reflected XSS in Contest Gallery, but the provided documents do not include concrete technical details (affected versions, root cause, or fix). Monitor for updates.

CVE-2024-30425

CVE-2024-30425 affects the WordPress Beaver Builder plugin (Beaver Builder) up to version 2.7.4.4. The issue is a stored cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. In practical terms, this means attacker-supplied input could be ...

CVE-2024-30503

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through = 4.0.6...

CVE-2024-30520

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Labib Ahmed Carousel Anything For WPBakery Page Builder allows Stored XSS.This issue affects Carousel Anything For WPBakery Page Builder: from n/a through 2.1...

CVE-2024-30423

CVE-2024-30423 is an Stored XSS vulnerability in the WordPress plugin Better Elementor Addons, affecting versions from n/a up to 1.3.7. The initial description attributes the flaw to improper neutralization of input during web page generation. Red Hat’s entry provides the same description. The co...

CVE-2022-47153

CVE-2022-47153 : Reflected Cross-Site Scripting in the WPJobBoard Jobeleon Theme (affected: Jobeleon Theme from n/a through 1.9.1) due to improper input neutralization during web page generation. Red Hat and Wordfence references corroborate the vulnerability and its cross‑site scripting nature bu...

CVE-2023-6371 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf...

CVE-2024-29238

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Log.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and...

CVE-2024-29230

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in SnapShot.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information...