CVE-2024-0852

coreActivity: Activity Logging plugin for WordPress (prior to 1.8.1) is vulnerable to unauthenticated Stored XSS due to insufficient escaping of certain request data when rendering in the admin logs dashboard. The issue allows an unauthenticated attacker to craft input that could execute JavaScri...

CVE-2024-0249

CVE-2024-0249 affects the WordPress plugin Advanced Schedule Posts (versions ≤ 2.1.8). The vulnerability is a Reflected Cross‑Site Scripting (XSS) caused by not sanitising/escaping a parameter before echoing it on the page, which could impact high‑privilege users (e.g., admins). Exploitation stat...

CVE-2023-7239

CVE-2023-7239 affects the WordPress WP Dashboard Notes plugin prior to 1.0.11. The vulnerability arises because the wpdn_update_note AJAX action does not validate that the requesting user has access to the specified post_id, enabling users with a Contributor role or higher to update notes created...

CVE-2023-7230

CVE-2023-7230 affects the WordPress plugin illi Link Party! (versions

CVE-2023-7231

The CVE-2023-7231 entry covers the illi Link Party! WordPress plugin (

CVE-2023-7196

CVE-2023-7196 affects the WordPress plugin Ultimate Noindex Nofollow Tool (versions

CVE-2023-7174

CVE-2023-7174 affects the WordPress plugin aBitGone CommentSafe (versions ≤ 1.0.0). The vulnerability arises from missing CSRF checks, lack of sanitisation and escaping, enabling a logged‑in admin to store XSS payloads via CSRF. Public documentation indicates the issue is present in 1.0.0 and ear...

CVE-2023-7197

CVE-2023-7197 affects Marketing Twitter Bot WordPress plugin (

CVE-2023-7088

CVE-2023-7088 affects the WordPress plugin Add SVG Support for Media Uploader (inventivo) up to version 1.0.5. The issue is that uploaded SVGs are not sanitized, allowing stored XSS via SVGs and enabling impact for users with as little as Author privileges. Publicly provided connected documents c...

CVE-2023-7086

The CVE-2023-7086 entry corresponds to the SVG Uploads Support WordPress plugin, affected up to version 2.1.1. The root cause is failure to sanitize uploaded SVG files, enabling stored XSS via SVG content (reported as exploitable by authors and higher). Public details in the provided documents co...

CVE-2023-6783

CVE-2023-6783 concerns the WolfNet IDX for WordPress plugin (

CVE-2023-6541

The CVE-2023-6541 entry concerns the WordPress Allow SVG plugin prior to 1.2.0, where uploaded SVGs are not sanitized, enabling stored XSS via SVG payloads uploaded by users with as little as Author privileges. Impact is cross-site scripting with low to moderate severity per sources; remediation:...

CVE-2023-5934

CVE-2023-5934 affects the Travelpayouts WordPress plugin: versions prior to 1.1.13 lack CSRF protection when importing v1 settings, enabling a CSRF attack to modify settings by a logged-in admin. Documented PoC/exploitation paths exist (e.g., WPScan/patchstack references). Vulnerability context s...

CVE-2023-5932

The CVE-2023-5932 issue concerns the WordPress plugin Travelpayouts: All Travel Brands in One Place, affected in versions prior to 1.1.14. The root cause is that a parameter is not properly sanitized/escaped before being echoed back in the page, enabling a Reflected Cross-Site Scripting (XSS) att...

CVE-2023-5529

Affected software: Advanced Page Visit Counter WordPress plugin, prior to version 8.0.6. Root cause: plugin does not sanitise/escape certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Impact: admin-level Stored X...

RaaS Explained: How Cybercriminals Are Scaling Attacks Like Startups

There is a lot of money in cyberattacks like ransomware, and unfortunately for organizations of all sizes, the…...

xorg: xwayland: Use-after-free in SyncInitTrigger()

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger is called. If one of the changes triggers an error, the function will return...

xorg: xwayland: Use-after-free in PlayReleasedEvents()

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free...

Ensure That Warning Banners Contain Proper Information

Warning banners contain warning information added on the system login page. Security warnings are displayed for all users who log in to the system. The security warnings must include information about the organization to which the system belongs, monitoring or records of login behavior, and legal...

Balancing Security and Liquidity: a Time-Weighted Snapshot Framework for DAO Governance Voting

As new project upgrading the blockchain industry, novel forms of attack challenges developers to rethink about the design of their innovations. In the growth stage of the development, Decentralized Autonomous Organizations DAO introduces different approaches in managing fund through voting in...