CVE-2024-1466

CVE-2024-1466 targets the WordPress plugin “Elementor Addons by Livemesh” (versions up to 8.3.4). The issue is a Stored Cross-Site Scripting flaw in the Posts Multislider widget via the slider_style attribute, caused by insufficient input sanitization and output escaping. Exploitation requires co...

CVE-2024-2198

CVE-2024-2198 concerns the WordPress plugin Contact Form by BestWebSoft, with a Reflected XSS vulnerability via the cntctfrm_contact_address parameter in versions up to 4.2.8. The issue arises from insufficient input sanitization and output escaping, allowing an unauthenticated attacker to craft ...

CVE-2024-0626

CVE-2024-0626 affects the WooCommerce Clover Payment Gateway plugin for WordPress. The root cause is a missing capability check in the callback_handler, leading to broken access control that allows unauthenticated users to mark orders as paid. Affected versions are

CVE-2024-2112

The CVE-2024-2112 entry concerns the WordPress plugin Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder, affected up to version 1.15.22. The vulnerability, described across sources (NVD/NVD-related, Red Hat, PatchStack), is Sensitive Information Exposure via the plugin’s sign...

CVE-2024-2436

The CVE-2024-2436 entry concerns the Lightweight Accordion WordPress plugin. It describes a stored XSS in the plugin’s shortcodes caused by insufficient input sanitization and output escaping on user-supplied attributes, affecting all versions up to and including 1.5.16. The vulnerability require...

CVE-2023-6777

CVE-2023-6777 affects WP Go Maps (WordPress plugin) up to version 9.0.34, enabling unauthenticated disclosure of the Google API key by embedding it in multiple plugin files. Attackers could use the exposed key to make API requests, potentially exhausting quotas and affecting map functionality. Pu...

CVE-2024-2165

CVE-2024-2165 affects the SEOPress – On-site SEO plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting via the image alt parameter in all versions up to and including 7.5.2.1, caused by insufficient input sanitization and output escaping. Exploitation requires authentication, w...

CVE-2024-1850

The CVE CVE-2024-1850 concerns the WordPress plugin AI Post Generator | AutoWriter up to version 3.3. It lacks a capability check on AJAX-handled functions, enabling authenticated users with subscriber access or higher to view all generated posts (including non-published), create/publish new post...

CVE-2024-1308

The CVE-2024-1308 entry covers the WooCommerce Cloak Affiliate Links plugin for WordPress up to version 1.0.33, where a missing authorization check in the permalink_settings_save function allows unauthenticated modification of the affiliate permalink base, enabling traffic redirection to maliciou...

CVE-2024-0826

CVE-2024-0826 affects Qi Addons For Elementor for WordPress. The vulnerability is a Stored Cross‑Site Scripting (XSS) in widget attributes caused by insufficient input sanitization and output escaping, allowing authenticated users with contributor-level or higher permissions to inject scripts tha...

CVE-2024-1960

CVE-2024-1960 is a Stored Cross-Site Scripting vulnerability affecting the ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules (WordPress plugin, formerly WooLentor) up to version 2.8.1. The issue arises from insufficient input sanitization and output escaping on user-supplied ...

CVE-2024-2423

CVE-2024-2423 affects the WordPress plugin UsersWP – Front-end login form, User Registration, User Profile & Members Directory . It is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode attributes in all versions up to and including 1.2.6, due to insufficient input sanitization ...

CVE-2024-3093

CVE-2024-3093 is a duplicate of CVE-2024-1752 for the Font Farsi WordPress plugin. Connected sources indicate the issue affects Font Farsi

CVE-2024-2261

CVE-2024-2261 affects the Event Tickets and Registration plugin for WordPress (all versions up to 5.8.2). The exposure is via RSVP functionality, enabling authenticated users with contributor access or higher to retrieve sensitive data (emails, street addresses). Remediation noted in connected so...

CVE-2024-2226

CVE-2024-2226 affects the Otter Blocks – Gutenberg Blocks plugin for WordPress. The vulnerability is stored XSS in the google-map block via the id parameter, present in all versions up to 2.6.4, due to insufficient input sanitization and output escaping. Exploitation requires an authenticated att...

CVE-2024-1641

CVE-2024-1641 affects the WordPress Accordion plugin. Vulnerability: missing capability check in the accordions_duplicate_post_as_draft function, affecting all versions up to 2.2.96. Impact: authenticated users with Contributor+ access can duplicate arbitrary posts, potentially exposing contents ...

CVE-2024-2342

CVE-2024-2342 affects the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments (plugin slug: simply-schedule-appointments). The vulnerability is an SQL Injection via the customer_id parameter in shortcode contexts, exploitable by authenticated attackers with contributor ac...

CVE-2024-2033

CVE-2024-2033 affects the Video Conferencing with Zoom plugin for WordPress (versions

CVE-2024-2187

CVE-2024-2187 : The Beaver Builder Addons by WPZOOM for WordPress is exposed to Stored Cross-Site Scripting via the Testimonials widget in all versions up to and including 1.3.4. The root cause is insufficient input sanitization and output escaping, enabling authenticated attackers with contribut...

CL0P's Ransomware Rampage - Security Measures for 2024

2023 CL0P Growth Emerging in early 2019, CL0P was first introduced as a more advanced version of its predecessor the 'CryptoMix' ransomware, brought about by its owner CL0P ransomware, a cybercrime organisation. Over the years the group remained active with significant campaigns throughout 2020 t...