CVE-2024-4462

CVE-2024-4462 concerns the Nafeza Prayer Time WordPress plugin. The description indicates a Stored Cross‑Site Scripting vulnerability in admin settings for all versions up to 1.2.9, caused by insufficient input sanitization and output escaping. The issue affects multisite installations and sites ...

CVE-2024-4997

CVE-2024-4997 concerns WPUpper Share Buttons for WordPress, claiming unauthorized access to password‑protected post/page contents up to version 3.43. The provided connected documents do not supply technical details, affected versions beyond 3.43, root cause, exploit info, or fixes.

CVE-2024-4697

CVE-2024-4697 is a WordPress plugin issue in Cowidgets – Elementor Addons. The vulnerability is a Stored Cross‑Site Scripting via the heading_tag parameter in all versions up to 1.1.1, caused by insufficient input sanitization and output escaping. It enables authenticated attackers with contribut...

CVE-2024-4273

CVE-2024-4273 involves the Essential Real Estate WordPress plugin, enabling Stored XSS via the ere_property_map shortcode in all versions up to 4.4.2 due to insufficient input sanitization and output escaping. The vulnerability requires authenticated access (Contributor level or higher) and could...

CVE-2024-4274

Technical details about CVE-2024-4274 are not provided in the supplied documents. The entries reference the Essential Real Estate WordPress vulnerability but do not include affected versions, exploit info, or remediation specifics. Monitor for official advisories.

CVE-2024-3230

The WordPress Download Attachments plugin is vulnerable to Stored XSS in all versions up to 1.3 via the download-attachments shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access (contributor level or higher) a...

CVE-2024-3031

CVE-2024-3031 refers to a Stored XSS in the Fluid Notification Bar plugin for WordPress, affecting versions up to and including 3.2.3. The vulnerability exists due to insufficient input sanitization and output escaping in admin settings, enabling an authenticated attacker with administrator-level...

CVE-2024-2382

CVE-2024-2382 affects the Authorize.net Payment Gateway For WooCommerce plugin for WordPress. The root cause is that the plugin does not properly verify the authenticity of the request that updates an order’s payment status, enabling an unauthenticated attacker to set the status to paid and bypas...

CVE-2024-2019

CVE-2024-2019 affects WP-DB-Table-Editor for WordPress. The Red Hat entry states the vulnerability arises from missing default capability checks on the dbte_render function in all versions up to 1.8.4, enabling authenticated attackers with contributor access and above to modify database tables co...

CVE-2024-3555

CVE-2024-3555 affects the WordPress plugin “Social Link Pages: link-in-bio landing pages for your social media profiles”. The root cause is a missing capability check in import_link_pages() across versions up to and including 1.6.9, enabling unauthenticated attackers to create arbitrary pages and...

CVE-2024-1717

CVE-2024-1717 affects the Admin Notices Manager plugin for WordPress. A missing capability check in handle_ajax_call() (all versions through 1.4.0) allows authenticated users with subscriber-level access or higher to retrieve the emails of registered users. The provided documents do not specify a...

CVE-2024-3888

CVE-2024-3888 affects tagDiv Composer (td-composer) for WordPress; stored XSS via the button shortcode in all versions up to 4.8 due to insufficient input sanitization and output escaping of user attributes. Attack requires contributor-level auth or higher and can inject scripts on pages loaded b...

CVE-2024-4552

CVE-2024-4552 affects the Social Login Lite For WooCommerce plugin for WordPress. Versions up to and including 1.6.0 are vulnerable to an authentication bypass due to insufficient verification of the user during social login, allowing unauthenticated attackers to log in as any existing user (e.g....

CVE-2024-4870

CVE-2024-4870 affects the WordPress plugin Frontend Registration – Contact Form 7. The vulnerability arises from insufficient restriction on the cf7frr post meta, in versions up to and including 5.1, enabling authenticated attackers with editor-level access and higher to modify the default user r...

CVE-2024-29976

Zyxel NAS326/NAS542 are affected by CVE-2024-29976 due to improper privilege management in the show_allsessions command. An authenticated attacker could obtain a logged-in administrator’s session cookies. Remediation is to upgrade to firmware versions V5.21(AAZF.17)C0 (NAS326) or V5.21(ABAG.14)C0...

CVE-2024-29975

CVE-2024-29975 relates to Zyxel NAS326 and NAS542 devices where an improper privilege management in the SUID executable binary could allow an authenticated local admin to run commands as root. Affected: NAS326 before V5.21(AAZF.17)C0 and NAS542 before V5.21(ABAG.14)C0. Impact is elevated privileg...

CVE-2024-29974

CVE-2024-29974 affects Zyxel NAS326 and NAS542 devices via a remote code-execution flaw in the CGI program file_upload-cgi. An unauthenticated attacker can upload a crafted configuration file to execute arbitrary code. Affected firmware versions are NAS326 before V5.21(AAZF.17)C0 and NAS542 befor...

CVE-2024-29973

CVE-2024-29973 affects Zyxel NAS326 (firmware < V5.21(AAZF.17)C0) and NAS542 (firmware

CVE-2024-29972

CVE-2024-29972 affects Zyxel NAS326 (firmware < V5.21(AAZF.17)C0) and NAS542 (firmware

CVE-2024-29152

The CVE-2024-29152 issue affects Samsung Exynos baseband software in multiple processors (Samsung Mobile Processor, Wearable Processor, Exynos 980–2400; Exynos Modem 5123–5300). The root cause is improper handling of states in the RRC Reconfiguration message, which can lead to disclosure of sensi...