CVE-2024-11219

CVE-2024-11219 affects Otter Blocks – Gutenberg Blocks, Page Builder for WordPress (WordPress plugin) up to and including v3.0.6. The issue is an unauthenticated path traversal vulnerability in the get_image function that allows viewing arbitrary images on the server, potentially exposing sensiti...

CVE-2024-11083 ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to...

CVE-2024-11083

The CVE-2024-11083 entry concerns the ProfilePress WordPress plugin. Affected software: ProfilePress plugin for WordPress, versions up to and including 4.15.18. Vulnerability: unauthenticated access allows sensitive information exposure by abusing WordPress core search to retrieve data from posts...

CVE-2024-10878

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attacker...

CVE-2024-10878 Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attacker...

CVE-2024-10878

CVE-2024-10878 affects the WordPress plugin Sugar Calendar – Lite (Sugar Calendar) up to version 3.3.0 . The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by improper escaping in the URL through the use of add_query_arg and remove_query_arg . This allows unauthenticated attackers...

CVE-2024-11024 AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possibl...

CVE-2024-11024 AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possibl...

CVE-2024-11032

CVE-2024-11032 : The Parsi Date WordPress plugin (versions ≤ 5.1.1) is vulnerable to a Reflected Cross-Site Scripting flaw caused by using add_query_arg without proper URL escaping. This allows unauthenticated attackers to inject arbitrary scripts into pages that run when a user is tricked into p...

CVE-2024-11032 Parsi Date <= 5.1.1 - Reflected Cross-Site Scripting via add_query_arg Parameter

The Parsi Date plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 5.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-11202

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cmindsfreeguide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-11202 Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cmindsfreeguide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-11202

CVE-2024-11202 affects multiple WordPress plugins that implement the cminds_free_guide shortcode. Root cause: insufficient input sanitization and output escaping, enabling unauthenticated attackers to trigger Reflected XSS in pages executed after user action. CVSS: 6.1 (Medium); attack vector NET...

CVE-2024-11202 Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cmindsfreeguide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-9504

CVE-2024-9504 affects the Booking calendar, Appointment Booking System plugin for WordPress, with an unauthenticated stored XSS via SVG uploads in versions up to 3.2.15 caused by inadequate input sanitization and output escaping. The vulnerability permits injection of script code that executes wh...

CVE-2024-9504 Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-10570 Security & Malware scan by CleanTalk <= 2.145 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 2.145, as well as insufficient input sanitization and validatio...

CVE-2024-10570

The CVE pertains to WordPress Security & Malware scan by CleanTalk (Secure plugin) where versions up to 2.145 allow an unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofing in checkWithoutToken and insufficient input sanitization. This enables unauthenticated attacker...

CVE-2024-11342

The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing or incorrect nonce validation in the skt-nurc-admin.php file. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2024-11418 Additional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site Scripting

The Additional Order Filters for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shippingmethodfilter' parameter in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for...