CVE-2024-5459

CVE-2024-5459 affects the Restaurant Menu and Food Ordering plugin for WordPress. All versions up to 2.4.16 are vulnerable due to missing capability checks on add_section, add_menu, add_menu_item, and add_menu_page, enabling authenticated users with Subscriber-level access and above to create men...

CVE-2024-1662

The CVE-2024-1662 entry describes a Missing Authentication for Critical Function / Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application, allowing retrieval of embedded sensitive data in versions before 2.02. Affected component is the PowerBa...

CVE-2024-5526

Grafana OnCall CVE-2024-5526 affects versions 1.1.37–1.5.1, with a Server Side Request Forgery (SSRF) vulnerability in the webhook functionality. The issue is resolved in version 1.5.2. Affected component: Grafana OnCall webhook handler. Impact described as SSRF; no explicit exploitation details ...

CVE-2024-4743

CVE-2024-4743 affects LifterLMS – WP LMS for eLearning. It is a SQL Injection via the lifterlms_favorites shortcode’s orderBy parameter in all versions up to 7.6.2, caused by insufficient escaping and incomplete query preparation. An authenticated attacker with Contributor-level access can inject...

CVE-2024-4821

Technical details beyond this entry are not provided in the supplied documents; monitor for updates from vendors/advisories.

CVE-2024-5571

CVE-2024-5571 affects the EmbedPress plugin for WordPress (EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, YouTube, etc.). It is a Stored XSS vulnerability in the EmbedPress PDF widget via the url attribute in versions up to 4.0.1, allowing authenticated attackers with contributor-level acces...

CVE-2024-1272

Affected software: TNB Mobile Solutions Cockpit Software. Vulnerability: Inclusion of Sensitive Information in Source Code allows retrieval of embedded sensitive data. Impact: confidentiality impact HIGH; integrity/availability not affected per provided details. Versions: before v0.251.1. Root ca...

CVE-2024-23669

CVE-2024-23669 affects Fortinet FortiWebManager; improper authorization could allow an attacker to execute unauthorized code or commands via HTTP requests or CLI. Affected versions include FortiWebManager 7.2.0, 7.0.0–7.0.4, 6.3.0, 6.2.3–6.2.4, and 6.0.2. CVSS details in the NVD indicate high imp...

CVE-2024-5439

CVE-2024-5439 : Blocksy Theme for WordPress is vulnerable to Reflected XSS via the custom_url parameter in all versions up to 2.0.50. Exploitation requires a user to click a crafted link (unauthenticated). A fix is available in Blocksy 2.0.51 (per changeset showing new version). If upgrading is n...

CVE-2024-4939

CVE-2024-4939 | Weaver Xtreme Theme Support (WordPress) is affected by a Stored XSS via the div shortcode in all versions up to 6.4. The issue allows authenticated attackers with contributor-level access and above to inject scripts that execute when users load the affected pages. The vulnerabilit...

CVE-2024-5453

CVE-2024-5453 affects the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. It enables unauthorized data modification via a missing capability check in pm_dismissible_notice and pm_wizard_update_group_icon across all versions up to 5.8.6. Authentication required: attackers wit...

CVE-2024-5006

CVE-2024-5006 (Boostify Header Footer Builder for Elementor, WordPress) is a Stored XSS vulnerability in the size parameter affecting all versions up to 1.3.2. The issue stems from insufficient input sanitization and output escaping, allowing an authenticated attacker (Contributor level or higher...

CVE-2024-4088

CVE-2024-4088 affects Gutenberg Blocks and Page Layouts – Attire Blocks for WordPress. The vulnerability arises from a missing capability check in the disable_fe_assets function (affecting all versions up to 1.9.2) which can allow authenticated attackers with subscriber access or higher to modify...

CVE-2024-5222

CVE-2024-5222: Stored XSS in the Responsive Addons WordPress plugin via the file uploader; affects all versions up to 3.0.5 and requires authentication (Author level or higher). A patch/update is available per connected disclosures; apply the vendor/maintainer update to remediate.

CVE-2024-1164

CVE-2024-1164 (Brizy – Page Builder for WordPress) stores cross-site scripting via the plugin’s form functionality. Connected sources confirm Brizy versions up to 2.4.43 are affected, with the vulnerability caused by insufficient input sanitization and output escaping on user-supplied error messa...

CVE-2024-2368

CVE-2024-2368 concerns Mollie Forms for WordPress. The flaw is CSRF due to missing/incorrect nonce validation in duplicateForm(), enabling unauthenticated attackers to trigger form duplication via forged requests if a site admin is enticed to click a link. Affected: all versions up to 2.6.13. The...

CVE-2024-4886

CVE-2024-4886 describes an IDOR vulnerability in the WordPress BuddyBoss Platform plugin where an authenticated user (Subscriber+) can comment on a private post by manipulating the numeric ID in the request. The issue is labeled as an insecure Directory Object Reference and affects BuddyBoss Plat...

CVE-2024-3667

The Brizy – Page Builder WordPress plugin contains a Stored XSS in the Brizy widgets’ Link To field (CVE-2024-3667). Affected versions are all up to and including 2.4.43. Exploitation requires authentication at contributor level or higher, enabling an attacker to inject scripts that run on pages ...

CVE-2024-2087

CVE-2024-2087 – Brizy (Brizy – Page Builder) for WordPress is a Stored Cross-Site Scripting (XSS) in which form name values are not properly sanitized/escaped, affecting all versions up to 2.4.43. This allows unauthenticated attackers to inject arbitrary JavaScript that executes when users load t...

CVE-2024-1940

The CVE-2024-1940 entry concerns Brizy – Page Builder for WordPress. Affected: Brizy Page Builder plugin for WordPress versions up to and including 2.4.41. Root cause: insufficient client-side input sanitization and output escaping in post content. Impact: Stored Cross-Site Scripting that can be ...